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ire CRO DEiC rl LON 


Eee PURPOSE 

As concern over the numerous cases of fraud, waste, abuse, 
and mismanagement of programs has grown, new legal amendments, 
directives and standards have been developed to strengthen 
internal control systems in the Federal Government as a prevent- 
ive measure. There is a critical need for "... Senior executive 
Service, Merit Pay, senior military equivalents and other 
civilian and military employees with significant management 
responsibilities ..." [Ref. 1] to gain a knowledge and under- 
Standing of the concept of internal control and their respon- 
Sibilities in this area in order to guide the implementation 
of effective systems within thelr organization. The purpose 
of this thesis is to provide the requisite knowledge and 


understanding for these Department of Defense (DOD) managers. 


B. BACKGROUND 

Despite the fact that internal controls have not been a 
major management priority, the recognition of their importance 
in the Federal Government is not new. The Accounting and 
Auditing Act of 1950 placed the responsibility for establish- 
ing and maintaining adequate systems of internal control upon 
the head of each executive agency. The Act encompassed not 
Srey systems of internal control that provide full disclosure 


of an agency's financial results, adequate financial 





information for agency management purposes, reliable accounting 
results and suitable integration of agency accounting with 
Treasury Department accounting, but also systems of internal 
control that provide effective control over the account- 
ability of all funds, property, and other assets for which 
the agency is responsible. Thus, as early as 1950, the law 
clearly indicated that proper systems of accounting and in- 
ternal control were necessary for program and operational 
activities, as well as for financial and administrative 
functions. 
Even so, the development of effective systems has been 
Slow. Recent public disclosures of fraud, waste, and abuse, 
and findings of poor internal controls such as those noted in 
a study by the U.S. General Accounting Office (GAO) have caused 
concern among responsible federal officials and taxpayers: 
-..- the loss to the Government on the 77,000 cases would 
total between $150 and $220 million. These losses are 
only what is attributable to known fraud and other 
illegal activities investigated by the Federal agencies 
ieetnis study. It does not include ... the cost of 
undetected fraud which is probably much higher because 
weak internal controls allow fraud to flourish ... the 
cost of fraud and illegal activities cannot always be 
measured in dollars and cents. Fraud erodes public 
confidence in the Government's ability to efficiently 
and effectively manage its programs. [Ref. 2] 

Within the last several years increased attention has been 

directed toward strengthening internal controls to prevent 

lllegal, unauthorized, or questionable actions, to help restore 


confidence in Government, and to improve its operations. 


These, and other developments, will be reviewed. 





©. SCOPE AND METHODOLOGY 

This thesis will provide a review and evaluation of the 
eternal control program in the Department of the Navy. 

The evolution of the term internal control will be put 
into perspective by presenting the development within the 
private sector and then comparing it to the evolution of the 
expression in the public sector. 

The theoretical background of R. N. Anthony's Planning and 
Control System and his management control process will be 
reviewed in order to provide a general structure within which 
to integrate the specific systems of internal control of the 
private and public sectors. 

Managers in both sectors share the common concerns of 
obtaining and utilizing resources effectively and efficiently 
in accomplishing the objectives of their organizations. Yet 
the definitive literature concerning the subject of establish- 
ing and reviewing internal controls provides assistance to 
independent auditors in their review of financial controls 
and does not address the spectrum of administrative, as well 
aS, accounting controls necessary to meet managers' 
requirements. As an assistance, a more comprehensive method- 
Ology for establishing an internal control system which 
emphasizes program and operational ccntrols, as well as 
financial and administrative ones, 1S presented for use by 


federal managers. 
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The internal accounting controls of the private sector 
will be integrated within Anthony's management control frame- 
work, as will DOD's Planning, Programming, and Budgeting 
System. 

A number of illustrative cases will demonstrate the 
inadequacy of focusing on the narrow inibexatenecion of internal 
accounting control when the real intent is management control. 

Finally, the conclusion is reached that management 
control--measures employed by management to reach its 
objectives--is the only meaningful framework within which the 
subsets of administrative and accounting controls must be 
combined for the effective and efficient accomplishment of 
the organizations’ objectives, whether of the public or 
private sector. 

The research consisted primarily of a detailed search and 
evaluation of the literature in the area of internal control 


and management control. 
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Pee VOL een, Or THE TERM INTERNAL CONTROL 


A. INTRODUCTION 

The following chapters will compare the development of 
the concept of internal control in the private sector with 
the evolution in the public arena. Topics to be considered 
are: definitional concerns, the establishment of a system of 
internal control and its purpose, the process of internal 
control reviews, and finally, a conceptualization of the 


concept from a management perspective. 


fee VOLUTION OF DEFINITION IN THE PRIVATE SECTOR 

A major concern with internal control in the private 
sector arises from the function of the independent audit -- 
the independent investigation of a business firm's financial 
statements by Certified Public Accountants (CPAs). In this 
context, management of the business firm is responsible for 
adopting sound accounting policies, accounting procedures, 
and the presentation of financial data. The independent auditor 
or CPA, based on his or her review of evidence relating to 
the reliability of financial data and the safeguarding of 
assets and records, provides an independent opinion on the 
fairness of management's presentation of financial data as 
a basis for third party reliance, 

Since the volume of transactions within most commercial 


firms precludes review of each and every economic event, one 
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of the ten Generally Accepted Auditing Standards states: 
There is to be a proper study and evaluation of the exist- 
figumiimcternal Control as a basis for reliance thereon and 
for the determination of the resultant extent of the 
tests to which auditing procedures are to be restricted. 
Peet. 3] 
Utilizing this professional standard established by the 
American Institute of Certified Public Accountants (AICPA) in 
the late 1940's, the auditor can effectively limit the amount 
Semwaudit evidence accumulated, if he believes that the client 
has a system of internal control which provides reliable 
Financial information and protects assets and records. If he 
determines any of the internal controls are inadequate, he 
cannot rely on them and must seek a greater quantity of 
evidence. 

Meee that this audit standard, as well as the other nine, 
is broad and does not provide a detailed methodology for 
accomplishment. It is meant to serve as a guide to the 
selection of the proper procedures based on the individual 
auditor's judgment of the pertinent methods appropriate to a 
Situation. In fact, judgment is heavily emphasized in the 
Beplication of audit standards. 

The definition of the term internal control has varied in 
the private sector since the 1930s. 

In 1949 the Committee on Auditing Procedures (CAP) of the 
AICPA formally defined the term as: 

Internal control comprises the plan of organization and 


all of the coordinate methods and measures adopted within 
a business to safeguard its assets, check the accuracy 


da 





Pmeereltaoility of Its accounting data, promote opera- 

tional efficiency, and encourage adherence to prescribed 

managerial policies. [Ref. 4] 
This definition is broader than the meaning presently at- 
tributed to the term by practicing auditors. By the inclusion 
of the phrase " ... promote operational efficiency and 
encourage adherence to prescribed managerial policies," this 
statement recognizes that a system of internal control extends 
beyond those matters which are directly of an accounting or 
financial nature. 

Such a system might include budgeting control, standard 

costs, periodic operating reports, statistical analysis ... 

a training program ... to aid personnel in meeting their 

responsibilities, and an internal audit staff to provide 

additional assurance to management as to the adequacy 

of its outlined procedures and the extent to which they 

are being carried out. It properly comprehends activities 

in other fields (such as) time and motion studies ... and 

use of quality controls. [Ref. 5] 

Such a definition was perceived as too expansive for 
Certified Public Accountants' purposes, so the accounting 
profession subdivided the term into accounting controls and 
administrative controls in an effort to narrow the auditor's 
review as it pertains to his examination leading to the ex- 
pression of an opinion on financial statements. In response 
Bemecitics of the above definition of internal control, CAP 
modified the definition in 1958 as follows: 

Internal control, in the broad sense includes: control 
which may be characterized as either accounting or 
administrative as follows: 

Accounting controls comprise the plan of organization and 
all the methods and procedures that are concerned mainly 


with, and relate directly to the safeguarding of assets 
and the reliability of the financial records, They 
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generally include such controls as the systems of authoriza- 
tion and approval, separation of duties concerned with 
record keeping and accounting reports from those concerned 
with operations or asset custody, physical controls over 
assets and internal auditing. 


Administrative controls comprise the plan of organization 
and all the methods and procedures that are concerned 
mainly with operational efficiency and adherence to 
managerial policies and usually relate only indirectly 

to the financial records. They generally include such 
controls as statistical analysis, time and motion studies, 
performance reports, employee training programs, and 
@uality controls. [Ref. 6] 


In 1963 CAP further narrowed the independent auditor's 
responsibility for evaluating internal control: 


The independent auditor is primarily concerned with the 
accounting controls. Accounting controls ... generally 
bear directly and importantly on the reliability of 
financial records and require evaluation by the auditor. 
Administrative controls ... ordinarily relate only 
indirectly to the financial records and thus would not 
require evaluation. [Ref. 7] 


Not everyone agreed with this limitation of the concept 
which served to narrow the scope of the independent CPA's 
review. In 1957 Paul Grady, chairman of CAP when the original 
broad definition was issued, commented on the controversy: 


The suggested narrowing of viewpoint, in my opinion, would 
constitute serious retrogression and impair the founda- 
tion of independent auditing. It may sound paradoxical, 
but there are many endeavors wherein a broader concept of 
responsibility results in a lesser risk. In the present 
international situation the recently announced Middle 
East Policy obviously broadens our responsibility. We 
have undertaken it, however, in order to lessen the risk 
of war. Similarly, the broader view of investigation and 
evaluation of internal control lessens the business risk 
inherent in the work of the independent auditor. [Ref. 8] 


Despite this warning, the auditing profession proceeded 


to practice the narrower concept. As time passed, the 
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ero eneeqaciicor 's evaluation of management's policies 
was found lacking in a number of legal cases. These legal 
proceedings applied the internal control concept as estab- 
lished in the inclusive 1949 framework when evaluating the 
auditor's actions. | 

Because of difficulties in interpretation, CAP felt that 
clarification of the two types of internal control was 
desirable. In 1972, the revised statements were promulgated 
as follows: 


Administrative control includes, but is not limited to 
the plan of organization and the procedures and records 
that are concerned with the decision processes leading 
to management's authorization of transactions. Such 
authorization iS a management function directly asso- 
Ciated with the responsibility for achieving the 
objectives of the organization and is the starting point 
for establishing accounting control of transactions. 


Accounting control comprises the plan of organization and 
the procedures and records that are concerned with the 
safeguarding of assets and the reliability of financial 
records and consequently are designed to provide reason- 
able assurance that: 


- Transactions are executed in accordance with manage- 
ment's general or specific authorization. 


- Transactions are recorded as necessary (1) to permit 
preparation of financial statements in conformity 
with generally accepted accounting principles or any 
other criteria applicable to such statements and (2) 
to maintain accountability for assets. 


- Access to assets is permitted only in accordance with 
management's authorization. 


- The recorded accountability for assets is compared 
with the existing assets at reasonable intervals 
and appropriate action is taken with respect to any 
differences. [Ref. 9] 
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The committee emphasized that accounting, not administra- 
tive, control was to be the focus of audits. 

Ignoring the court's interpretation of internal control 
in legal actions and ae SEC disciplinary proceedings against 
auditors, in 1975, Statement on Auditing Standards (SAS) 

No. 9 explicitly narrowed the traditional reference to an 
evaluation of internal control to read "... evaluation of 
internal Bee ooncne control." This clearly separates internal 
control into that of a "financial" nature versus "management" 
Semncrol. 

During this period of the mid-1970's the Securities and 
Exchange Commission (SEC) censured several of the large audit- 
ing firms for lack of independence and certification of false 
Financial statements and inadequate audit procedures. Asa 
result, the public began to question the reliability of 
corporate financial statements and the role of the independent 
auditor. The AICPA requested that the Commission on Auditor's 
Responsibilities develop conclusions and recommendations 
regarding the appropriate responsibilities of independent 
auditors. This commission included a number of prominent 
non-accountants, Findings included the following: 

The Commission observed that financial reporting has 
become a continuous process rather than an annual event. 
Much of the information is therefore, unaudited ... 

More importantly users are implicitly relying on an 
adequate system of internal controls. Internal controls 
assure that unaudited information released by corporations 


is materially accurate. The Commission observed the 
societal concern over illegal and questionable corporate 
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Payments and the attention focused on corporate account- 
ability and the importance of controls over the accounting 
system. The Commission noted that the adequacy of internal 
controls iS an important investment criterion to creditors 
and shareholders. The Commission ... recommended that 

the auditors expand their study to review and test the 
entire accounting control system ... greater involvement 

of the auditor in the corporate reporting system and a 
change in the auditor's focus ... to the examination of 
Eeuniction. {Ref. 10] 

Before the Commission on Auditor's Responsibilities issued 
its final report, the Auditing Standards Board of the AICPA 
issued SAS No. 20 in December 1977. This statement required 
auditors to inform management of material weaknesses in 
internal accounting control but it also continued to limit 
the scope of the auditor's review: 


... there is no requirement under generally accepted 
auditing standards to evaluate each control ..." [Ref. 11] 


The independent auditor is only expected to test the controls 
upon which he intends to rely. 

During this same time period, the media reported on several 
cases of falsified corporate records and maintenance of off- 
the-books slush funds. 

As a result, Congress passed, and President Carter signed, 
the Foreign Corrupt Practices Act (FCPA) of 1977. Bribes or 
payments to foreign officials and others to obtain or retain 
business were indeed prohibited by this legislation but the 
important provisions required all publicly held companies to 
establish and maintain adequate systems of internal account- 


ing control defined as: 
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~-- a System of internal accounting controls sufficient 
to provide reasonable assurance that: 


- transactions are executed in accordance with management's 
general or specific authorization 


- transactions are recorded as necessary to permit prepara- 
tion of financial statements in conformity with generally 
accepted accounting principles or any other criteria 


applicable to such statements, and to maintain account- 
ability for assets 


- access to assets 1S permitted only in accordance with 
management's general or specific authorization 


- the recorded accountability for assets is compared with 
the existing assets at reasonable intervals and approp- 
riate action is taken with respect to any differences. 

Note that these points are directly derived from the profes- 
Sional auditing literature, namely CAP's 1972 clarification 
of the types of internal control. 

In its interpretation of the internal accounting control 
provisions of the FCPA, the American Bar Association warned: 

-.. Foreign bribery is a relatively rare event, but 

maintenance of financial records and internal accounting 

controls are major everyday activities of every registered 

Or reporting company ... (this may be) the most extensive 

application of federal law in internal corporate affairs 

Since the passage of the 1933 and 1934 (security) Acts 

... (others) foresee at least the possibility that the 

new statute will create extensive new liabilities for 

corporate managements, auditors, and corporate counsel. 

[Ref. 12] 

The AICPA appointed the Special Advisory Committee on 
Internal Accounting Control to provide guidance to management 
in reviewing and implementing internal controls. The forward 
to the Committee's report states that the broad guidance in 
the professional literature had been developed for the limited 


purpose of the auditing profession and noted the need to 


provide guidance helpful to management. 
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The Committee declared that management should be concerned 
with all of its internal accounting controls and cited the 
following broad definition from SAS No. 1 for management's 
purposes: 

The foregoing definitions (of .internal accounting control 
and administrative control) are not necessarily mutually 
exclusive because some of the procedures and records 
comprehended in accounting control may also be involved in 
administrative control ... For practical purposes, this is 
tantamount to including within the definition of accounting 
controls any administrative controls that have an important 
bearing on the reliability of the financial statements. 

Thus the statement underlines the fact that as far as 
managers are concerned administrative and accounting controls 
are interrelated and both types reinforce management controls -- 
measures employed to obtain the organization's objectives. 

This discussion was not meant as a historical review of 
actions in the private sector but rather was an attempt to 
illustrate the development of the concept of internal control 
in the private sector from a broad expansive term, to a 
narrow limited focus for the benefit of the auditing profes- 
Sion and a final recognition by that same profession that 
management's concerns are broader and that therefore the 


controls contemplated in the 1949 definition are more 


appropriate for them. 


See vOLUTION OF DEFINITION IN THE PUBLIC SECTOR 
As part of Reform 88, the Reagan Administration is com- 
mitted to streamlining the management and administration of 


the federal government. This initiative includes reducing 
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fraud, improving management controls and eliminating errors 
in the administration of government programs. 

In October 1981, the Office of Management & Budget (OMB) 
issued Circular A-123 on internal control systems as an early 
effort to improve these systems. The circular defined require- 
ments and responsibilities in order to transform the 1950 
Act's expectations into reality. It prescribed policies and 
Standards for executive agencies in establishing and maintain- 
ing internal controls in their program and administrative 
momMe FIONS. 

At that time OMB defined Internal Control (as): 

the plan of organization and all of the methods and measures 
adopted within an agency to safeguard its resources, assure 
the accuracy and reliability of its information, assure 
adherence to applicable laws, regulations and policies, 

and promote operational economy and efficiency. [Ref. 13] 


This definition is very Similar to the 1949 AICPA broad 


Semcept of internal control in that it includes: 


OME -Caneu lar 1949 Definition 
= the safeguarding of resources - safeguarding assets 
= assuring the accuracy and re- - check the accuracy and 
liability of its information reliability of its 


accounting data 


= assuring adherence to applica- - encourage adherence to 
ble laws, regulations and prescribed managerial 
policies policies 

= promote operational economy - promote operational 
and efficiency efficiency 


in fact, based on the parallel construction above, this 


definition is even more general than the original private 
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sector statement. In this format, it has served as the basis 
for much of the guidance promulgated to executive federal 
agencies. 

However, in August 1983, OMB issued a revised Circular 
A-123 which redefined Internal Control (as): 

the plan of organization and methods and procedures adopted 

by management to provide reasonable assurance that obliga- 

tions and costs are in compliance with applicable law; funds, 

property and other assets are safeguarded against waste, 

loss, unauthorized use, or misappropriation; and revenues 

and expenditures applicable to agency operations are properly 

recorded and accounted for to permit the preparation of 

accounts and reliable financial and statistical reports 

and to maintain accountability over the assets. [Ref. 14] 
Note that this focus 1S narrower and related closely to the 
auditing profession's 1958 delineation of accounting controls. 
All references to the administrative controls, those of ad- 
herence to applicable laws, regulations, and policies and the 
promotion of operational economy and efficiency have been 
dropped. 

The Department of Defense (DOD) promulgated OMB's original 
Circular A-123 by issuing DOD Directive 7040.6, Internal Control 
Systems, 24 March 1982. This document established DOD's pro- 
gram of internal control, assigned responsibilities and 
provided procedures to ensure that DOD resources are efficiently 
and effectively managed. It also appropriated OMB's original 
broad definition of internal control. 


A policy statement of the directive served to support the 


broad formulation of the term: 
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micermal controls are management's responsibility and 


should be in effect across the board in every organiza- 
tion within each DOD component. Adequate internal 
control is required to assure that all resources are 
efficiently and effectively managed and is the basic 
foundation for integrity in any management system. 
Although internal controls in themselves cannot prevent 
every incident of waste, mismanagement and fraud, DOD 
policy is to ensure that resources are properly managed 
and controlled within the Department of Defense. [Ref. 15] 

BeGrevaision Of DOD's directive is currently in draft form 
and a review of it indicates that DOD has adopted OMB's 
revised definition of internal control but has chosen to 
title it Management Control. It is interesting to note that 
a number of other definitions within the revision emphasize 
the "management" control aspect yet use the same meanings 
OMB has ascribed to internal control with an accounting focus, 
1.e€., management control review, management control system. 

The revised paper still retains the original DOD policy 
statement concerning management's responsibility in relation 
Ber internal controls. 

In September 1982, Congress passed the Federal Managers' 
Financial Integrity Act (FMFIA), an amendment to the pre- 
viously mentioned Accounting and Auditing Act of 1950 which 
placed the cognizance for the effectiveness of financial 
Management systems in preventing fraud, waste, and abuse upon 
federal managers. 

One provision of the FMFIA requires that: 

Internal accounting and administrative controls ... shall 


provide reasonable assurances that obligations and costs 
are in compliance with applicable law; funds, property 
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and other assets are safeguarded against waste, loss, 
unauthorized use, or misappropriation; and revenues and 
expenditures applicable to agency operations are properly 
recorded and accounted for. [Ref. 16] 

The revised definitions of internal control issued by OMB 
and DOD are certainly better aligned with the objectives of 
this provision which does not mention program results or 
operational economy and efficiency. 

Secretary of the Navy Instruction (SECNAVINST 5200.35), 
itjectnal Control in the Department of the Navy, was issued on 
29 July 1983. It implemented the original versions of OMB's 
Circular and the DOD Directive, as well as the FMFIA, within 
the DON and established the Navy's own program to develop, 
maintain, review and improve internal control systems to en- 
sure resources are efficiently and effectively managed. 

Since DON's instruction is based on the first publications 
of OMB and DOD, one would expect that the Navy's definition 
would support the broader connotation of internal control and 


it does: 


... the plan of organization and all of the methods and 
measures adopted within the DON to: 


-- Safeguard resources and assure the accuracy and 
Gol vabtlity Of iniormation (accounting controls) 


-- Assure adherence to applicable laws, regulations, 
and policies and promote operational economy and 
efficiency (administrative controls. 


Internal controls are management controls and apply to 


the entire range of DON programs and functions. 
(Ref. 17] 


24 





Verocstatements wWltehin» tnis instruction also stress the 
management aspects of internal controls: 


--. implementing and carrying out an internal control 
program iS a management responsibility. 


Vulnerability assessment. A management evaluation ... 
Management control review ... reviews performed by 
Managers responsible for the program/function under 
review ... [Ref. 18] 
It 1s most likely that DON will revise its recent instruc- 


tion to better coordinate with the latest guidance from OMB 


ana DOD. 


Dee CONCLUSION 

By now it should be clear that there are a number of 
Similarities in the evolution of the definition of internal 
control within the private and public sectors. Both have 
long recognized the importance of adequate systems of control. 
Both sectors began with a broad definition of internal con- 
trol and each has moved to a more limited view. Much impetus 
for current interest in this subject has developed because of 
recent legislation to correct failings in operations: the 
FCPA in the private sector and the FMFIA in the public sector. 
There is little guidance in either sector on specifics; broad 
direction is all that is provided. 

In the private sector, the major portion of the profes- 
Sional literature has been directed toward the purposes of 
the independent auditor who uses his own evaluation of 
management's system as a basis to limit the scope of his 


audit tests in financially related areas. 
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The public sector has taken the literature originated 
for these narrow purposes and tried to superimpose it on 
systems of internal control where a non-independcdent management 
has sagpensiistliiee aes its stewardship of all resources. 

It 1S unclear that the approach advocated by the auditing 
profession and the AICPA is necessarily correct for either 
Poolic or private sector management. The inclusive interpre- 
tation as defined in 1948 can provide administrative, as well 
aS accounting data -- all information management is responsible 
for. Thus, as Grady stated in 1957, "a broader concept of 


responsibility results in a lesser risk." 
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it ooo eo OL INTERNAL CONTROL 


A. INTRODUCTION 

Management is responsible for establishing and maintaining 
its system of internal controls in order to provide reliable 
data, safeguard assets and records, and promote operational 
efficiency. The pioneer literature in this area of management 
planning and control systems was published in the 1960's by 
R. N. Anthony. A discussion of his framework will be presented 
in this section, as well as descriptions of internal control 


systems within the private and public domains. 


B. ANTHONY'S MANAGEMENT CONTROL FRAMEWORK 
1. Planning and Controlling Processes 

fn His’ book, Planning and Control Systems: A Framework 
for Analysis, Anthony presented his concept of systems designed 
to facilitate planning and control processes within organiza- 
mons, Whether profit or nonprofit. 

Within the framework of deciding what to do and how to 
femtte (planning) and assuring results are attained (controlling), 
three main categories of internal activities carried on in an 
organization at different times, by different people, or for 
different situations can be delineated, Figure l. 

eeceegieuplenning 1s defined as the process of 
deciding on objectives of the organization, on changes in 


these objectives, on the resources used to attain these 
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EXAMPLES OF ACTIVITIES IN A BUSINESS ORGANIZATION INCLUDED IN 
MAJOR FRAMEWORK HEADINGS 


* ** kKkK* 
Pesacegre Planning Management Control Operational Control 


** 
RK 


Choosing company 
objectives 


Planning the 
organization 


Setting personnel 
policies 

Setting financial 
policies 

Setting marketing 
policies 

Setting research 
policies 

Choosing new 
product lines 

Acquiring a new 
division 
Deciding on non- 


routine capital 
expenditures 


Formulating budgets 
Planning staff levels Controlling hiring 


Formulating personnel Implementing policies 
practices 


Working capital Contre! Ling 
planning extension 
Formulating adver- Controlling placement 
tising programs of advertisements 


Deciding on 
research projects 


Choosing product 
improvements 


Deciding on plant Scheduling production 
Lea taangemiene 


Deciding on routine 
capital expenditures 


Formulating decision Controlling Inventory 
rules for operational 
Gontrol 


Measuring, appraising Measuring, apprais- 
and improving man- Lig, ane ano rovindg 
agement performance workers' efficiency 


Planning activities 


Planning & Controlling activities 
Controlling activities 


Figure l 


(Ret 220! 
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objectives, and on the policies that are to govern the 
acquisition, use and disposition of these resources. 

"Strategy" is used in its usual sense of combining and 
employing resources. It connotes big, important plans with 
major consequences. "Objectives" are what the total organiza- 
tion wishes to accomplish and Tieden eee guidelines to be 
used in the choice of the most appropriate course of action 
for accomplishing the objectives. 

Another type of planning 1S concerned with the con- 
tinuing administration of the organization and is closely 
associated with control activities. This is management 
control, the process by which managers assure that resources 
are obtained and used effectively and efficiently in the ac- 
complishment of the organization's goals. Three important 
ideas are conveyed by this statement: the process involves 
managers, people who get things done by working with others; 
the process occurs within a context of objectives and policies 
that have been arrived at in the strategic planning process; 
the criteria for judging the actions in this process are 
effectiveness and efficiency. This is the root of the term as 
used in the DOD and DON documents mentioned in the previous 
chapter. 

Since the line dividing strategic planning from manage- 
ment control is blurred as one process interacts and shades 
into the other, figure 2 attempts to delineate significant 


distinctions between the two processes. 
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soME DISTINCTIONS 


Wmaracteristic 


Focus of plans 


Complexities 


Beqgree of structure 


Nature of 
marOormation 


Communication of 
iecrOormatilon 


Purpose of estimates 
Persons primarily 
involved 


Number of persons 
involved 


Mental activity 
Source discipline 


Panning and control 


Time horizon 


End result 


Apprisal of the 
job done 


CONTROL 


Strategic Planning 


On one aspect at a time 


Many variables 

Unstructured and 
irregular; each 
problem different 

Tailor made for the 
problem; more 
external and predic- 
tive; less accurate 


Relatively simple 


Show expected results 


Sate ancl op 
management 


Small 


Creative; analytical 


Economics 


Planning dominant, 
DUE Some COntro. 


Tends to be long 


Policies and 
precedents 


Extremely difficult 


Figure 2 


yt 


BETWEEN STRATEGIC PLANNING AND MANAGEMENT 


Management Control 


On whole organiza- 
eallong! 


Less complex 


Rhythmic; pres- 
cribed procedures 


integrated; more 
internal and 
HIStEOr Leads: 
accurate 


more 
Relacrve tyr? ft ieu it 
Lead to desired 


results 


Line and top 
management 


IEsuage |S 

Administrative; 
persuasive 
Social psychology 

Emphasis on both 
planning and 
GOnETO. 

Tends to be short 

Action within 
policies and 


precedents 


Much less 
slaieesketbulie 
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The third element is based on the distinction between 
the activities referred to as management and activities that 
relate to the performance of specific tasks. 

Operational control is the process of assuring that 
specific tasks are carried out effectively and efficiently. 

Distinguishing characteristics between operational 
control and management control are that operational control 
focuses on specific tasks or transactions, whereas management 
control focuses on the flowing stream of continuing operations; 
operational control is essentially objective in the sense that 
it has to do primarily with activities for which the correct 
decisions can be objectively determined. At least concept- 
Ually, and often practically, a valid decision rule can be 
Stated mathematically and programmed into a computer. Manage- 
ment control is essentially subjective in that decisions in 
this process inherently involve management judgment and there 
1s no objective or "scientific" way of determining the best 
@emrse Of action in a situation. 

As with the distinction between strategic planning and 
management control, the distinction between management control 
and operational control is ill-defined, the processes overlap 
and are interrelated. Figure 3 is presented to clarify the 
categories. 

Despite the presentation of these Cdiscrete elements, 
the planning and control process is a continuum. Management 


control is a process carried on within guidelines established 
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SOME DISTINCTIONS BETWEEN MANAGEMENT CONTROL AND OPERATIONAL 


Con EROL 
Characteristic Management Control 
meeus Of activity Whole operation 
Judgment Relatively much; 


subjective decisions 
Nature of structure Psychological 


Nature of information Integrated; finan- 
cial data through- 
out; approximations 
acceptable; future 
and historical 


Persons primarily Management 
involved 
Mental activity Administrative; 
persuasive 
Source discipline Social physchology 
meme horizon Weeks, months, years 
Type of costs Managed 
Figure 3 
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Operational Control 


Single task or 
transaction 


Relatively little; 
reliance on rules 


Rational 

Tailormade to the 
operation; often 
non-financial; 
precise; often in 
real time 


Supervisors (or 
none) 


Follow directions 
(or none) 


Economics; physical 
sciences 


Day=tO-Gay 


Engineered 
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by strategic planning. Objectives, facilities, organization, 
and financial factors are accepted as given operational 
SBenstraints. Operational control ee place within a context 
of decisions made and rules formulated in the management con- 
trol process and to some extent in the strategic planning 
process. Overall performance of operational control activities 
are reviewed as part of the management control process. 

Anthony discusses two other processes distinct from 
management control. The first 1s information handling, the 
process of collecting, manipulating and transmitting informa- 
tion, whatever its use. The author presents two reasons for 
regarding this process as separate from the other elements. 
Although useful for planning and control, information is 
primarily handled for a functional purpose and the system 
is designed to meet the requirement of these purposes. Also, 
there is a recognized body of knowledge and skill, an expert- 
ise, which identifies information handling as a separate process. 

The first three processes are concerned with activi- 
ties which occur inside an organization. The final process has 
an external orientation. 

Financial accounting is defined as the process of 
reporting objective financial information about the organiza- 
tion to the outside world. The distinction is made that 
society has developed certain financial accounting principles 
to which all businesses are expected to adhere, whereas no 


such externally imposed principles govern management control 
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meeoema £108 le maececOunteLng InfobMalion useful to internal 
parties for solving problems and achieving goals. 

Figure 4 interrelates the five topics just discussed. 

The management control process, the starting point in 
constructing a planning and control system, will Be discussed 
in more detail below. It is this system which deals with the 
continuing operation of the whole enterprise. 

2. The Management Control Process 

PMeManageiemt Contron in Nonprofit Organizations, 
Anthony and Herzlinger recognize the informal and formal 
process concerned with an organization's current operations. 
The informal management control process consists of memoranda, 
meetings, and conversations. The formal management control 
system includes information on planned (or estimated) and 
actual data on outputs, goods and services, and inputs, 
resources. Prior to actual operations, decisions and esti- 
mates are made as to what outputs and inputs are to be; during 
actual operations, records are maintained as to what output 
and input actually are; and subsequent to operations, reports 
are prepared that compare actual outputs and inputs to planned 
outputs and inputs and action is taken on the basis of these 
m= Orcs. 

The formal management control process, figure 5, 
Bensists of the following steps which occur in a regular, 


meemrring cycle: 
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Eee INGeAND COUTROL PROCESSES IN ORGANIZATIONS 
iMieernaliy Oriented Processes 
s@ratecie Plannince € 
Management 
Coneeol < 
Operational 


Externallv Oriented Process 


EMmanecilal ACCOUNntInG 


Figure 4 
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external 






gudgeting 


External : 
Information ma~, : 
F 
; External 
z wo i 
a 
Co, 
fo eee at koo S ft 
“wv strateg>© External 
Information 
Paguiscs> 
[Ref. 23] 


26 





Programming 

Budgeting 

Operating and Measurement 
Reporting and Analysis. 
a. Programming 

In this phase, decisions are made with respect to 
the major programs the organization plans to undertake during 
the coming time period. These decisions are usually made in 
the context of the objectives and strategies that have already 
been determined. It is within this step that the strategic 
and management control processes merge. 

Organizations may state their programs in the form 
of a long-range plan which shows planned outputs and inputs 
for a number of years ahead, three, five or as many as twenty 
years. 

In an industrial company, the "programs" are usually 
business lines or products. In a nonprofit organization, the 
principal programs are the mission areas, such as strategic 
forces, intelligence and communications, research and develop- 
ment, and training programs within the Navy. The plans state 
the amount and character of resources, inputs, to be devoted 
to each program and the ways in which these resources are to 
be used. The accounting information used at this point is 
program data and provides full cost information for a specific 
program. 

Where possible, program decisions are based on a 


comparative economic analysis as to whether the estimated 
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benefits from the program are equal or greater than the esti- 
mMaeea COSts. For many programs, particularly in nonprofit 
organizations, reliable estimates of benefits cannot be made. 
In these cases, deciSions are based on judgments and are 
influenced by the persuasive abilities of program advocates, 
and by aed ater and other ee eee 

b. Budgeting 

A budget is a plan expressed in quantified terms 
covering a specified period of time, usually one year. In 
this process, the program is translated into terms that cor- 
respond to the sphere of responsibility of those who must 
execute it. Thus, the plans of the program phase are con- 
verted into organizational terms in the budget phase. The 
process of arriving at this budget is essentially one of 
negotiation between the managers of individual units, respon- 
sibility centers, and their superiors. The end product of the 
negotiations is a statement of the outputs that are expected 
during the budget year and the resources that are to be used 
in achieving these outputs. 

This budget is a bilateral commitment. Responsi- 
bility center managers commit themselves to produce the plan- 
ned output with the agreed amount of resources and their 
superiors commit themselves to agreeing that such performance 


is satisfactory unless circumstances change. 
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c. Operating and Management 

During the period of actual operations, records 
are kept of resources actually consumed and outputs actually 
achieved. The records of resources consumed (costs) are 
Structured so that costs are collected by program and by 
organization. Program costs are used as a basis for future 
programming and organization costs are used to measure the 
performance of the heads of organizational units. Related 
to the collection of information is the process of internal 
auditing. It consists of procedures intended to ensure that 
the information is accurate and that the opportunities for an 
undetected departure from plans and policies, and for theft or 
defalcation are kept to a minimum. In organizations of any 
size, a separate internal auditing organization exists to 
ensure adherence to these procedures. 

ad, Reporting and Analysis 

Accounting information, as well as nonquantifiable 
and nonmonetary data is summarized, analyzed and reported to 
those who are responsible for knowing what is happening in 
the organization and for improving performance. These reports 
essentially compare planned outputs and inputs with actual 
Outputs and inputs. 

The information is used for three purposes: asa 
bases for coordinating and controlling the current activities 
of the organization, as a basis of evaluating operational 


managers performance, and as a basis for program evaluation. 
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Thus the closed loop of the four steps of a management control 
system are demonstrated in that evaluation of actual performance 
can lead back to the first step, a revision of the program. 

Anthony makes some generalizations about management 
control systems based on his analysis. [Ref. 24] 

A formal management control system is a total sys- 
tem in the sense that it embraces all aspects of the organiza- 
tion's operations. Such a total system provides information 
necessary so that management can ensure all parts of the 
operation are in balance with one another. 

A management control system should be designed so 
that the actions it leads managers to take in accordance with 
their perceived self-interest are also actions that are in the 
best interest of the organization. This is the concept of 
goal congruence. 

A management control system is built around a 
financial structure with resource expressed in monetary units. 
Money is the common denominator by means of which the hetero- 
Seneous elements of resources can be combined and compared. 
Thus, the accounting system serves as a unifying core for all 
types of information. Although this monetary focus is central, 
nonmonetary measures are also important parts of the system. 

A management control system should be a coordinated, 
integrated system. Data collected for different purposes 


should be reconcilable with one another. 
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EMeHmenough the controller of an organization is 
responsible for the design and operation of the management 
control system, decisions about management control should be 
made by line managers. Their judgments are incorporated in 
the approved plans, and they are the persons who must influence 
Others. Staff people, such as the controller, present informa- 
tion that is useful in the process. TOHeUee: Eners lonir kcant 
decisions are those of line managers. 

Based on this theoretical background of the ele- 
ments of a planning and control system and the process of 
Management control, the following sections will compare the 
establishment of systems of internal control in the private 
and public sector. 

Soo lLABLISHMENT OF A SYSTEM OF INTERNAL CONTROL IN THE 

PRiVATE SECTOR 

As organizations strive to attain their objectives, manage- 
ment is responsible for establishing and maintaining its system 
of internal controls in order to provide reliable data, safe- 
guard assets and records, promote operational efficiency, and 
encourage adherence to prescribed policies. 

i Lransaction Cycles 

Since the independent auditor places primary emphasis 

on the first two of the above concerns, in establishing its 
System of internal control, the private sector firm emphasizes 
the general objectives of authorization, accounting, and asset 


safeguarding to ensure the prevention of errors in the recording 
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SeeconOmic transactions. These general goals are tailored to 

meet Specific objectives within each financial transaction 

cycle of a particular company. Transaction cycles are the 

processes used to initiate and gemtern related activities, 

create the necessary documentation, and gather and report 

related data. Traditionally, there are five of these cycles 

within the private sector: 

er CLE EXAMPLES OF AREAS INVOLVED 

fee REVENUE Customer acceptance, credit, shipping, sales, 
Sales deductions, cash receipts, receivables, 
allowance for doubtful accounts, accounting 


for warranties, etc. 


2. EXPENDITURE Purchasing, payroll, cash disbursements, 
accounts payable, accrued expenses, etc. 


fee PRODUCTION Inventory valuation, property accounting, 


@r cost of sales, etc. 
CONVERSION 
4, FINANCING Capital stock and debt, investments, treasury 
SOCK, WSeOCck OOETONS, Gividenas, etc. 
5. EXTERNAL Preparation of financial statements and related 
FINANCIAL Gisclosures of other financial information, 
REPORTING including controls over financial statement 


valuation and estimation decisions, selec- 
tion of accounting principles, unusual or 
nonrecurring activities and decisions, and 
those which are not transactional in nature, 
such as contingencies. [Ref. 25] 
Figure 6 shows the flow of financial transactions 
for each of these cycles and the interrelationship between 
them. Some firms uSe a smaller or larger number of these 


ErvelLes. 
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Figure 6 
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eee oMeelt Ere uControl Objectives and Procedures 
Within the revenue cycle, specific control objectives 
with specific control procedures and techniques to ensure they 
are met are aeeetes ccd here: 
Pee in CYCLE 
Specific Objectives Control Procedures and Techniques 


Authorization Objectives 


Types of goods and services - Authorization procedures for 
to be provided nonstandard goods or services 
Credit terms and policies - Established credit policies 
should be properly 

authorized - Policies for investigating 


GUustoner Credit WOretiIiness 


—- Periodic review of credit 
limits 


Accounting Objectives 


Deliveries of goods and = Procedures COracecount for all 
services should result in shipments and comparison of 
preparation of accurate Shipments and billings. 


and timely billing forms. 
- Independent checks of quantity 
of goods shipped. 


Asset Safeguarding Objectives 


Access to cash receipts and - Independent control of cash 
related records should be receipts (lock box, cash 
controlled to prevent un- register) 
recorded cash receipts or 
abstraction of recorded - Restrictive endorsement of 
cash receipts checks upon receipt 

- Segregation of duties: cash 


receipts, recording of sales, 
customer credits, accounts 
Feceivaple. [Ret, 27] 
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Se) E@ements of Internal Control 
Factors that shape the internal accounting control 
environment include: 


pemea well-defined Organization plan with clear lines of 
authority and responsibility 


-- competent, trustworthy personnel 

-- adequate segregation of duties 

Sa PEODeCr procedures for authorization 

-- adequate documents and records 

== physical controls over assets and records 
-- independent checks on performance. 

Along with a proper functional division of the activi- 
ties of an organization, responsibility for the performance of 
duties must be specifically assigned so that accountability 
can be maintained and corrective action implemented as 
necessary. 

The careful selection of competent, trustworthy person- 
nel cannot be overemphasized. Honest, efficient people can 
perform at a high level even when few other controls are 
operational. 

Adequate segregation of duties includes the separa- 
tion of the following functions: authorization of, accounting 
for, custody of, and recordkeeping duties related to assets. 

An organization structure that allows this separation of duties 
will lessen the likelihood of fraud but opportunities still 


exist for collusion or management override. 
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Each transaction must be properly authorized. General 
authorizations allow employees to process transactions within 
the limits set by management policy. Specific authorizations 
are applied to individual transactions where approval is 
granted on a case-by-case basis. 

Documents and records are the physical objects upon 
which transactions are entered and summarized. They serve to 
transmit information through an organization and to other 
organizations. The documents must provide reasonable assurance 
that assets are properly controlled and transactions are cor- 
rectly recorded. 

The most important type of protective measure for 
safeguarding assets and records is the use of physical controls 
such as inventory storerooms, safes, backup records. 

The requirement for internal verification arises 
because a system tends to change over time unless there 1s a 
mechanism for frequent review. Personnel are likely to forget 
procedures, become careless, or intentionally fail to follow 
them unless someone is there to observe and evaluate their 
performance. Fraudulent and unintentional errors are always 
possible regardless of the quality of the controls. It is 
important that internal verification be done by a person 
independent of the original preparer of the data. A "built-in" 
system of internal verification includes the separation of 


duties previously discussed. 
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fee IinternaleAudit Function 

An internal audit staff is widely used by larger firms 
to review their internal control system. This organization 
performs many of the same investigative and evaluative func- 
tions of the independent auditor. The primary difference is 
that this staff is not independent of management whereas the 
independent auditor must be so in order to remain credible 
with third parties. Although the independent auditor is not 
permitted to rely entirely on evidence accumulated by internal 
auditors, the existence of an adequate staff can greatly reduce 
the evidence he must gather during his external audit. 

An important point should be noted here: the internal 
control system itself is a preventive measure; internal auditors 
review the operation of an implemented system, a detection 
Measure. With an effective, efficient system, there should be 
few adverse findings by an internal audit staff. 

These elements of internal control were originally 
defined in 1948 and were reaffirmed by the Special Advisory 
Committee on Internal Control in 1979. 
aeesolLABLISHMENT OF A SYSTEM OF INTERNAL CONTROL IN THE 

PUBLIC SECTOR 

As in the private sector, management in executive federal 
agencies is responsible for establishing and maintaining 
internal control systems which prevent the occurrence of 


potential risks in a cost effective manner. 
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The public sector has relied heavily on procedures estab- 
lished for commercial business. 

Ll. Event Cycles 

Ui-eelestestep in the public sector in Sétting up a 
system of internal control is the identification of event 
cycles. This is the same concept as the financial transaction 
cycles within the private sector but it has been expanded by 
the OMB Guidelines for the Evaluation and Improvement of and 
Reporting on Internal Control Systems in the Federal Government 
to include each program and administrative function performed 
within an executive agency or component of it. Appendix B of 
the Guidelines presents a list of a limited number of event 
cycles commonly found in federal agencies along with suggested 
Specific internal control objectives for each one. Unfortunately, 
this appendix does not provide corresponding control techniques 
to ensure the objectives are met. Such information would be 
helpful for these specific objectives and serve as a basis for 
extrapolation to design internal control review processes 
that are appropriate for each organization's specific objec- 
tives within its unique transaction cycles. 
Arthur Andersen & Co. suggests an alternative method 


of organizing the events that affect each agency: 
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evCLeE EXAMPLES OF AREAS INVOLVED 


ime POLICY AND Policy and plans are developed 
PLANNING 
me 6C BUDGET Budget 1S approved; appropria- 


tions and allotments are made 


3. PROGRAM Resources are used to accomplish 
agency missions. 


4, ADMINISTRATIVE Resources needed for programs 
are acquired and controlled 


5. REPORTING Previous events are summarized 
and reported. [Ref. 28] 


The interrelationships of these cycles are shown in figure 7. 

Within this proposed methodology, there are numerous 
@eogram, Or mission cycles: grants, loans, income security, 
defense, regulatory, law enforcement, research and development, 
information and intelligence, taxation, insurance, production 
of goods and services, and construction; as well as a number 
of administrative cycles: personnel, procurement, disburse- 
ments, receipts, asset and liability management, and adminis- 
trative support. 

Figure 8 parallels the Similar picture from the private 
sector, illustrating the flow of transactions and the inter- 
relationships between them. 

2. Specific Control Objectives and Procedures 

To further relate these ideas to the previous discus- 
Sion of the private sector, specific control objectives with 
their specific control procedures or techniques for the defense 


program cycle are shown here. 
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Figure 8 


(Ref. 30] 
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Policy & Planning Cycle B. 


Define Objectives 

Prepare plans 

Define policies 

Operational decisions 

Asset Safeguarding Measures 

Authorize Transactions 

Processing 
Substantiate, 
Reports 


Evaluate 


Program Cycle Ds 


Planning 

Resource Requisition 

Develop Standards for Program 
Execution 

Management of resources 

Monitor Accomplishment of 
Program Objectives 
Redirection of Resources as 
needed 


Reporting Cycle 


Record Posting 

Gathering of Supplemental 
Pneormation 

Transaction Preparation 

Consolidation of Component 
Data 

Report Preparation 


Budget Cycle 


Plan, schedule process 
Develop forms 

Train 

Coordiante personnel 
Consolidate data 

Submit budget 

Control & communicate changes 
Distribute approved budget 
Monitor budget vs actual 


Administrative Cycle 


Draft Bid Requests 

Advertise 

Evaluate Bids 

Acquire property, goods & 
services 

Receiving 

Sliaueeny sCOnE mo. 
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DEFENSE PROGRAM CYCLE 


Specific Objectives 


Control Procedures or Technigues 


UE clal(oneslvAsh Esker gl 


Strategic and tactical 
defense plans should be 
authorized in accordance 
with laws, regulations, 
treatires, and management 
Bolicy. 


The command, base, or unit 
activities should be auth- 
oerized in accordance with 
laws, regulations, treaties 
and the strategic and 
tactical defense plans 


The deployment of forces and 
weapons should be authorized 
in accordance with laws, 
regulations, treaties and 
tactical plans. 


Operating procedures should 


be established and maintained 


in accordance with 
management's policy. 


All plans down to the unit and 
base level are approved by the 
proper command level. 


Written defintions of authorized 
activities for each command, 
base and unit are provided to 
commanders. 


Communication of strategic and 
bacelcal plans’. 


Command chain is defined and 
followed. 


Communication networks are used 
to authorize and report actions. 


Fail-safe approvals are required 
for Cmeelcal activities. 


Detailed disposition planning. 
Reports of unit deployments. 


Reports of weapon inventories 
are made. 


Defined operating procedures. 


hia 1 Wing, 


Transaction Processing* 


Only those requests to 
utilize weapons and troops 
that are in accordance with 
defense plans and manage- 
ment's policy should be 
approved. 


Automated systems report unit 
Sears. 


Systems report resources 
available. 


Be 





Use of troops and weapons in 
exercises and other activi- 
ties should be accurately and 
promptly reported. 


Materials and supplies, 
ammunition, fuel and other 
resources used in conduct- 
ing exercises and other 
activities should be 
accurately and promptly 
reported. 


Cost accounting systems linked 
to operating systems. 


Inspections held. 
Physical inventories conducted. 


See above. 


See above. 


Giwacsit reatton * 


Activities carried out and 
related costs should be 
accurately classified, 
summarized, and reported. 


Changes in disposition of 
troops and weapons and 
related costs should be 
accurately applied to the 
proper records. 


Costs of resources utilized 

in conducting defense acti- 

vities should be applied in 

the proper accounting period 
to the financial systems. 


Cost accounting systems that 
report costs of resources used. 


Management review of cost 
reports. 


Iimtennal, auaits of financial 


records. 


See above. 


See above, 


Eivstca lv oaseguards+ 


Access to weapons and 
resources should be permit- 
ted only in accordance with 
laws, regulations, treaties 
and management's policy. 


Arsenals and other 
safeguards. 


physical 
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Access to records, forms, MiMbearysoOl LCe . 

processing areas and 

processing procedures should Base physical access controlled. 
be permitted only in accord- 

ance with law, regulation [Ref. 31] 
and management's policy. 


* Accounting Objectives 


+ Asset Safeguarding Objectives 


3. Standards for Internal Controls in the Federal 
Government 
The FMFIA requires that " ... internal accounting and 


administrative controls of each executive agency shall be 
established in accordance with standards prescribed by the 
Comptroller General" of the GAO. The definitive standards 
were issued 1 June 1983. These general and specific standards 
are a melding of the private sector's general control objec- 
tives of authorization, accounting and asset safeguarding and 
the factors that shape the internal accounting control 
environment, aS well as a few original elements. 
a. General Standards 

(1) Reasonable Assurance. Control systems are to 
provide reasonable assurance that the objectives of the system 
Will be accomplished. The standard recognizes that the cost 
of a control should not exceed the benefits derived therefrom 
and that the benefits consist of reductions in the risks of 
Failing to achieve the stated control objectives. This evalua- 
tion of costs and benefits requires estimates and judgments 


by management. 
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(2) Supportive Attitude. Managers and employees 
are to maintain and demonstrate a positive and supportive 
attitude toward controls at all times. 

(3) Competent Personnel. Managers and employees 
are to have personal and professional integrity and are to 
maintain a level of competence that allows them to accomplish 
their assigned duties, as well as understand the importance 
of developing and implementing good controls. 

(4) “Conner olwObjeeceives. (Specific) control objec- 
tives are to be identified or developed for each agency activity 
(program or administrative function) and are to be logical, 
applicable, and reasonably complete. 

(5) Control Technigues, Control techniques are 
to be effective and efficient in accomplishing their control 
objectives. These techniques are to be designed to accomplish 
the specific control objectives consistently. When in place 
and functioning properly, these methods and procedures prevent 
errors and, as such, can be considered strengths in the sys- 
tem of internal control. 

See opeciiic otandards 

(1) Documentation. Control systems and all trans- 
actions and other significant events are to be clearly 
documented and the documentation is to be readily available 


fore examination. 
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(2) Recording of Transactions and Events. Trans- 
actions and other significant events are to be promptly 
recorded and properly classified. 

(3) Execution of TranSactions and Events. Trans- 
actions and other significant events are to be authorized and 
executed only by persons acting within the scope of their 
authority. Independent evidence is to be maintained that proper 
authorizations are issued and that the transactions conform 
with the terms of the authorizations. 

(4) Separation of Duties. Key duties and responsi- 
bilities in authorizing, processing, recording, and reviewing 
transactions should be separated among individuals. Key 
duties such as authorizing, approving, and recording trans- 
actions, issuing or receiving assets, making payments, and 
reviewing or auditing are to be assigned to separate individ- 
uals to minimize the risk of loss to the government. Internal 
management control depends largely on the reduced opportunities 
to make and conceal errors or to engage in, or conceal 
irregularities. This, in turn, depends on the assignment of 
work so that no one individual controls all phases of an 
activity or transaction, thereby creating a situation that 
permits errors or irregularities to go undetected. 

(so) supervision. Qualified and continuous super- 
Vision is to be provided to ensure that control objectives are 
achieved and to ensure that approved procedures are followed. 
Lines of personal responsibility and accountability are to 
be clearly established. 
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Koen ccesoeeorandesccOuntability for Resources. 


Access to resources and records is to be limited to authorized 
individuals, and accountability for the custody and use of 
resources is to be asSigned and maintained. Periodic compari- 
son shall be made of the resources with the recorded account- 
ability to determine whether the two agree. The frequency of 
the comparison shall be a function of the vulnerability of 
the asset. 

c. Audit Resolution Standard 

(1) Prompt Resolution of Audit Findings. Managers 
are to promptly evaluate findings and recommendations reported 
by auditors, determine proper actions in response to audit 
findings and recommendations, and complete, within established 
timeframes, all actions that correct or otherwise resolve the 
matters brought to management's attention. 
4. Internal Audit Function 

As mentioned previously, large private firms maintain 
internal audit staffs to detect breakdowns in their internal 
control systems. Corresponding functions in the public sector 
include internal review, internal audit, and the inspector 
general. 

a. Internal Review 

Internal Review is defined by SECNAVINST 7510.8A 

of 7 December 1982 as the conducting of audits, studies, 
analyses, or evaluations of command operations. It provides a 


responsive, independent, in-house means to detect deficiencies, 
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improprieties, or inefficiencies, and to provide recommenda- 
tions to correct conditions which adversely affect mission 
accomplishment or command integrity. 

Internal reviews can be used in any operational 
or functional area to ensure that resources have been em- 
ployed effectively, efficiently, and within legal and adminis- 
trative constraints. As stated previously, its purpose is to 
detect after-the-fact deficiencies, improprieties and inef- 
ficiencies as opposed to the preventive objectives of internal 
Sencrol. 

The ideal placement of the function is as a staff 
Capacity to the commanding officer to ensure independence from 
operational activities and objectivity in the internal evalua- 
Mien Of the organization. 

A review of the instruction indicates that sections 
on programming for internal review and the actual conducting 
of an internal review are closely related to aspects of the 
internal control program and the function of auditing 
respectively. As in the internal control program, this pro- 
gram requires an annual activity review plan to provide 
adequate coverage for functional areas with known or suspected 
problems and components must prepare an inventory of review- 
able areas, the major functions performed by the activity. 
Consideration is given to expected benefits of a review and 


the risk associated with not reviewing an area. Priority is 


SN, 





given to reviews in highly vulnerable MMC S ; ChOSe aAcCtLV1i— 


ties most susceptible to-fraud, waste, or illegal activity as 
determined by command vulnerability assessments. 

The actual conduct of a review parallels the 
steps auditors would follow in their examination of an 
organization. Standards, to be discussed below, are speci- 
fied; reviews address financial, compliance, effectiveness 
and efficiency, or program issues or a combination of these; 
reviews evaluate the adequacy of internal controls; the uSe 
Seeaucdit programs addressed to specific functional areas is 
encouraged; working papers are to be maintained, the review, 
reporting, and follow-up procedures all rely on the auditor's 
eeproach. 

SECNAVINST 7510.8A states internal audit, func- 
tion of the Naval Audit Service, and internal review are not 
duplicative, but rather supplemental to each other. Within 
DON, internal audit tailors its audit coverage in recognition 
@eeinternal review evaluations. Therefore, internal review 
efforts complement, rather than duplicate, those of internal 
audit. 

b. Naval Audit Service (NAS) 

The Auditor General of the Navy has responsibility 
for the Navy's internal audit program. 

The overall objective of the Naval Audit Service 
is to assist Navy managers at all levels in the effective 


discharge of their responsibilities by: 
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~- furnishing objective analyses, appraisals, recommenda- 
tions, and pertinent comments concerning the activities 
and programs reviewed; 

- determining whether prescribed Navy policies and pro- 
cedures in any area of operations are being complied 
jal elp\e 


- and determining whether the interests of the Govern- 
ment are being adequately protected. 


By disclosing the exiStence of unauthorized or 
improper practices and the causes of errors, audit provides 
protective service to management. When management policies 
are found to be ineffective or procedures are found to be 
uneconomical, the auditor can recommend appropriate action. 

Audit reviews all aspects of operations that 
involve the use of public funds or resources and makes rec~ 
ommendations to improve the efficiency and effectiveness of 
operations. 

LEwusmiiNS seOLtey tO Conduct audits of naval 
organizations and programs on a misSion-oriented basis. Other 
functions are examined based upon the degree to which they 
support mission accomplishment. 

Comprehensive audits evaluate the adeguacy of 
policies and procedures, the effectiveness and efficiency of 
operations and the accuracy of records and reports in both 
mission and support departments. 

c., Inspector General of the Navy 

The Inspector General Act of 1978 formally estab- 

lished this function which basically replicated the Service's 


auditing and internal review roles. In order to increase 
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economy and efficiency in the executive branch of the govern- 
ment, the Inspector General's basic responsibilities were 
defined.as: 

- Conducting and supervising audits and investigations 
relating to the programs and operations of their 
agencies; 

- Providing leadership and coordination and recommend- 
ing policies for other activities designed to promote 
economy and efficiency and prevent and detect fraud 
and abuse in such programs and operations; and 

- Keeping their agency head and the Congress informed 
about the administrative problems and deficiencies 


and the necessity for and progress of corrective 
actions. 


peo tanaakas for Audit of "Governmental Organizations, 


Programs, Activities, and Functions 

All three of the above programs must meet the Standards 
for Audit of Governmental Organizations, PEOgm ais sence lvwnclels , 
and Functions issued by the Government Accounting Office (GAO). 

As mentioned in Chapter II, the AICPA has adopted 
standards applicable to private sector audits performed to 
express opinions on the fairness of the presentation of 
financial statements. 

GAO has incorporated these guidelines into its own 
Standards for government audits but in recognition of the 
broader interests of many users of government audit reports, 
has also included additional standards for expanded scope 
audits. 

Officials and employees who manage public programs 


must be prepared to render a full account of their activities 
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to public officials, legislators, and the taxpaying public. 
These parties are interested in knowing whether government 
funds are properly handled and in compliance with laws and 
regulations and whether government organizations are achiev- 
ing the purposes for which programs were authorized and funded 
and are doing so economically and efficiently. 

Therefore, GAO's standards provide for the concept of 
expanded scope auditing to ensure full accountability. The 
three elements of expanded scope auditing are: 

- Financial and compliance, determines: whether the 
financial statements present fairly the financial 
position and whether laws and regulations that have 
a material effect upon the financial statements have 
been complied with. 

= Economy and efficiency, determines: whether resources 
are being managed economically and efficiently, the 
causes of inefficiencies or uneconomical practices, 
whether laws and regulations concerning economy and 
efficiency have been complied with. 

- Programs Results, determines: whether the desired 
results or benefits established by the legislature 
or other authorizing body are being achieved and 
whether the agency has considered alternatives that 
might yield desired results at a lower cost. [Ref. 32] 
Within the framework of the three elements of the 

concept of expanded scope audit, the various AICPA and GAO 
standards are applied. Internal controls are mentioned 
specifically as described below. 

Pewomeareiculac audit 1s focused on financial and 
compliance areas, the AICPA auditing standards are applicable 


with the following additional requirement in the reporting 


eleca > 
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The auditors shall report on their study and evaluation 
of internal accounting controls made as part of the 
financial and compliance audit. They shall identify as 

a minimum: (1) the entity's significant internal ac- 
Beunting COntrols, (2) the controls identified that 

were evaluated, (3) the controls identified that were not 
evaluated, and (4) the material weaknesses identified as 
a result of the evaluation. [Ref. 33] 

If a particular audit emphasizes economy and efficiency 
or program results, the unique GAO examination and evaluation 
Standard requires that: 

During the audit a study and examination shall be made 
of the internal control system (administrative controls) 
applicable to the organization, program, activity, or 
mameccion under audit. [Ref. 34] 

A corresponding reporting standard for government 
audits of economy and efficiency or program results requires 
iat : 

The report shall include ... a description of material 
weaknesses found in the internal control system (administra- 
meaye controls). [Ref. 35] 
Thus GAO has recognized the importance of administrative and 
accounting internal controls even though it has separated 
their reviews in different types of audits. An organization 
@Seamnot separate its controls in the continuing effort to 
reach its objectives through effective and efficient manage- 
ment of its resources. 

Recognizing that the Navy's instruction on internal 
control is quite recent but also noting that the original 
OMB guidance was published in October, 1981, it is still 


Mmeclear how these similar functions relate and interact with 


the internal control program. 
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Office of the Comptroller's (NAVCOMPT) letter of 
2 July 82 stated that the majority of internal control reviews 
are to be performed by Navy Audit Service (NAVAUDSVC) and 
command or activity internal review components; SECNAV's 
letter of 5 January noe stated that personnel performing 
internal control reviews may be auditors; internal reviewers, 
inspectors, Supervisors, etc.; and NAVCOMPT's letter of 
5 April 83 provided that management (changed from internal) 
control reviews were to be performed by the managers 
responsible. It is not surprising that activities have been 
confused about the integration of these functions. 

The best current guidance available makes these 
distinctions: internal reviews are more structured, are done 
as a staff function to the commanding officer by personnel 
independent of operational responsibilities, and the findings 
are kept within the command, whereas internal control reviews 
are less structured, are done by the managers involved in the 
program or administrative function, and the findings are 
referred up through the chain of command. Internal review 
staffs are encouraged to provide training and guidance in 
the design and review of internal control systems, but man- 
agers should not actually establish and maintain their own 
systems in order for the full benefit to be attained. 

Further definitive clarification among these functions 
is greatly needed to distinguish between them and avoid 


Sue lLication of effort. 
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E. SUMMARY 

Reviewing this chapter it is clear that neither CPA firms 
nor the public sector has really integrated its internal 
control system in the broader framework of management control 
but rather have chosen to emphasize internal accounting 
controls which are closely related to operational controls. 
(Later we will see that corporate management has taken the 
broader approach to management control.) Such a system does 
not focus on the wider information needs of managers for 
administrative, as well as accounting, data necessary to 
monitor the continuing operations of an organization as it 
strives to attain program and financial goals. 

It iS recognized that each organization is unique and 
internal controls must fit the particular situation but all 
systems should be integrated in the broader framework of 
Management control. 

There is a danger of attempting to adapt the financial 
auditing literature written for professional auditors' 
limited purposes (CPA audits) since these writings provide 
managers with little enlightenment for their decision making 


and planning and control requirements. 


Pee “lLMITATIONS OF INTERNAL CONTROL 
Whether in the public or private sector, the establish- 
ment of an internal control system can provide reasonable, 


but not absolute assurance that the organization's activities 
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are being accomplished in accordance with its specific 
objectives. 

In SAS No. 1, the AICPA has identified internal control 
limitations: 


In the performance of most control procedures, there 

are possibilities for errors arising from such causes 

as misunderstanding of instructions, mistakes of judg- 
ment, and personal carelessness, distraction or fatigue. 
Furthermore, procedures whose effectiveness depends on 
segregation of duties obviously can be circumvented by 
collusion. Similarly, procedures designed to assure the 
execution and recording of transactions in accordance 
with management's authorizations may be ineffective 
against either errors or irregularities perpetrated by 
management with respect to transactions or to the esti- 
mates and judgments required in the preparation of 
financial statements. In addition to the limitations 
discussed above, any projection of a current evaluation 
of internal accounting control to future periods is 
subject to the risk that the procedures may become 
inadequate because of changes in conditions and that the 
degree of compliance with the procedures may deteriorate. 
meet. 36] 


Internal control must be dynamic adapting to the ever- 
changing external and internal environment within which an 
evolving organization operates. Loss of a key employee, 
introduction of a new function, activation or de-activation 
@eean activity or facility are all events requiring a decision 
to determine whether existing controls should be reduced, 
increased, or simply maintained. 

Considerations of cost/benefit and reasonable assurance 
require management to maintain a constant awareness of sys- 
tem limitations as well as organizational vulnerability and 
risk. The direct and indirect costs of excessive controls 
can far outweigh the risks of adequate, but not absolute, 


Semcrol. 
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ye noe OF ENTE RNAL CONTROL SYSTEMS 


A. INTRODUCTION 

This chapter will compare the review of internal control 
systems as done in both the private and public sectors and thus 
demonstrate the closeness of oe procedures despite the fact 
that the examinations of systems were originally intended to 


have different goals. 


EeeeOVERVIEW OF AUDIT PROCESS IN THE PRIVATE SECTOR 
ime oludy Of —eheveCurrent System 

The private sector auditor begins his review of the 
internal control system by obtaining a general understanding 
of the client's industry and the client's specific business 
Since the nature of that business affects the controls a 
company must have to provide reliable financial data and to 
safeguard assets. Interviews with the chief financial officer 
and other key personnel help the auditor develop a knowledge 
of the formal internal control procedures established by the 
firm. A detailed organization chart and the procedures manual 
are useful in studying the prescribed system. The data ob- 
tained should provide an overview of the system. 

In order to obtain more specific information about the 
flow of documents and records and the nature of specific 
internal controls, the auditor uses flowcharts and internal 


control questionnaires. 
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A flowchart provides a diagrammatic representation 
of the client's documents and their sequential flow through 
Mie Organization. The origin, subsequent processing, and 
the final disposition of each record is illustrated. The 
flowchart also provides information concerning the separation 
of duties, authorizations, approvals and internal verifica- 
tions that occur within the system, as well as facilitating 
the identification of inadequacies of present system operations. 

The final format of the flowchart should describe the 
system and procedures actually in place which may be quite 
different from those established by management. Interviews 
with involved employees and auditor observation produce this 
accurate picture. 

After the flow diagram is completed, the auditor 
selects a "Sample of one" of each source document described 
mene £lowchart and follows it from its origin to its final 
disposition -- a "walk-through" test. Increased understanding 
of the system, as well as disclosure of errors or incomplete 
portions of the flowchart, are benefits gained by this 
procedure. 

An internal control questionnaire is designed to 
ask a series of questions about the controls in each audit 
area as a means of indicating to the auditor aspects of the 
system that may be inadequate. It is designed to require a 
yes or no response with a no response indicating potential 


fmaek Of internal control. 
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The main advantage of the questionnaire is the rela- 
tive completeness of coverage of each audit area that a good 
Survey device affords. The main disadvantage is that an 
overall view of the entire cycle is not provided. 

As with flowcharts, it is important to determine 
feeener Management *s prescribed controls are actually being 


followed. 


ee fol mM nagwebVvatuetton Of the System - Compliance 
Testing 


Once the independent auditor understands how the 
internal accounting control system functions, he makes a 
preliminary assessment of existing controls, noting strengths 
which prevent errors and weaknesses which permit errors or 
irregularities. 

This preliminary evaluation is done for each financial 
transaction cycle on an individual basis by testing a repre- 
sentative sample of documents in a walk-through test. Internal 
control techniques or procedures should have been established 
to ensure specific control objectives are met. If the auditor 
finds these methods in place and operational, he can assume 
that information generated in this area is likely to be correct 
and therefore, reduce, not eliminate, the extent of his tests 
for monetary errors (substantive tests). If evidence gathered 
indicates that internal control techniques have not been 
established or are not functioning, the auditor's expectation 


Mtr Oors in that area rises and he must increase the amount 
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of evidence accumulated to ensure that the potential error 
is immaterial. It is during this phase of the evaluation, 
called compliance testing, that the auditor identifies material 
weaknesses (Figure 9) in the internal control systems. 
3. Substantive Tests of Financial Balances 
Substantive audit tests are tests for monetary errors 
in transactions and account balances. These tests are partly 
based on the auditor's recognition of the strengths and weak- 
nesses of the client's internal control system during compliance 
testing. These further tests are to determine whether the 
ending balances and footnotes in financial statements are 
fairly stated. Substantive tests reduce the risk that any 
material errors that occur will not be detected by the 
examination. 
4. Reevaluation 
After all substantive tests are completed, the auditor 
summarizes his findings for all financial transaction areas 
to determine if sufficient evidence has been accumulated to 
issue an audit opinion. 
meee AUGTt Opinion 
The type of audit opinion given depends on the results 
of the compliance and substantive tests. If significant 
errors have been found, it may be necessary to reevaluate the 


quality of internal control. 
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CONSIDERATIONS OF MATERIALITY IN THE 
PRIVALS SECTOR 


The concept of materiality as it relates to auditing is 


simply that the auditor should concentrate on the financial 


statement information that 1S important ... more likely to be 


Significantly misstated ... in a given situation, the auditor 


must establish whether the account or transaction under con- 


sideration contains errors or omissions that, when combined 


with other possible errors in the statements, will make the 


Overall financial statements misleading. 


Important facets: 


Materiality is a relative concept rather than an 
absolute one. 


Net income is the usual basis for evaluating 
materiality. 


The combined errors are more important than errors in 
individual accounts. 


Accounts with small recorded balances can contain 
Maeer ial ecrreors,. 


Figure 9 {[Ref. 37] 
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"As companies contiue to grow, auditing must concentrate on 
testing management's systems of controls if any semblance of 
audit efficiency is to be maintained. As auditors rely more 
and more on management's control systems, they must develop 
a more pervasive understanding of the client's business and 
transactions. Thus, the broader definition of internal 
control may be a more useful approach to performing an 
effective independent audit. [Ref. 38] 


ee OVERVIEW OF THE REVIEW AND UPDATING OF PUBLIC SECTOR 

INTERNAL CONTROL 

OMB's Guidelines for the Evaluation, Improvement of and 
Bepotting On Internal Control Systems in the Federal Government 
of December 1982 are based primarily on the technigues just 
described for use by independent auditors in the private 
sector but are also expanded to encompass controls necessary 
for program and operational activities. In light of the recent 
revisions to pertinent documents, it is questionable how long 
this expanded view will last. 

Be that as it may, the public sector segments the review 
process into three phases, figure 10. 

1. Phase 1: Organizing the Evaluation 

This phase includes the assignment of internal control 
responsibilities within agencies and the identification of 
agency components and programs and functions. The OMB Guide- 
ges Provide general instructions in these areas and SECNAVINST 
5200.35 addresses Navy particulars. 
A point of clarification should be made here: The 

draft DOD Directive defines the term Assessable Unit as an 


fieencified function within an organizational unit with 


Fes. 





INTERNAL CONTROL REVIEW PROCESS 


EHASE 1 


Assign Internal 


Control] Responsi 
bilities ie 




















Identifv Agency 
Camponents 


Teentify Programs 
and Functions 








PHASE 2 PHASE 3 
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Acsecsccments ACt1ions 
Analyze Genera Identify 
Control Transaction 
Environment Cycles 
Analyze Analyze Genera 
Inherent Risk Control 
Environment 
Preliminary pocumen 
Evaluation of iranscaction 
Safequards Cvcles 
Summarize Evaluate 
Results Internal 
Controls 


Test. Internal 
Controls 


Report the 
Results 


Hague, 10 


fRee. 39] 
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significant management responsibilities. Within each organiza- 
tional unit, the manager is responsible for developing, main- 
taining, and monitoring a system of management control regarding 
the mission function and the common management functions 

within the organizational unit ... this approach, a combination 
of organization and functions, provides for an efficient span 

of control by assigning primary responsibility to the organiza- 
tion unit manager for managing the process (and) performing 
management control reviews. 

According to SECNAVINST 5200.35 each command and 
activity is to " ... select the programs/functions which repre- 
sent a Significant level of effort within an organization. 
These major areas should then be broken down into (subprograms/ 
Sieunctions)~ which are the aspects of the major area per- 
formed by the command/activity. For example, "Supply" ata 
field activity might be broken down into warehousing, SERVMART, 
Be@op stores, etc." 

2. Phase 2: Vulnerability Assessment 

A vulnerability assessment 1S a management evaluation 
of a program or function aimed at identifying the potential 
for mismanagement, loss, fraud, or waste in that program or 


function. The objective of these assessments is to attain a 


tithe Navy Instruction uses the term assessable units here. 
In light of DOD's definition above, the better choice of words 
is: subprograms/subfunction. 
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ranking of all programs and functions within an organization 
in terms of their suSceptibility to loss or unauthorized use 
of resources, errors in reports or information, illegal or 
unethical acts and/or adverse or unfavorable opinions. 
Steps in the vulnerability assessment process include: 
a. Analysis of General Control Environment 
The factors used here are drawn directly from the 
GAO document, Executive Reporting on Internal Controls in 
Government and the previously mentioned AICPA document, Report 
on the Special Advisory Committee on Internal Accounting Control. 
They include: management attitude, organization structure, 
personnel delegation and communication of authority and respon- 
Sibility, budgeting and reporting practices, and organizational 
checks and balances. 
b. Analysis of Inherent Risk 
This second step is the performance of an analysis 
For each identified program and administrative function of the 
inherent potential for waste, loss, unauthorized use or mis- 
appropriation due to the nature of the program or function. 
c. Preliminary Evaluation of Safeguards 
A preliminary judgment is made regarding the 
existence and adequacy of internal control over the specific 


programs and administrative functions subject to the guidelines. 
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d. Summarizing the Results of Vulnerability Assessments 
The reviewer makes an overall assessment of the 
adherence of the program or administrative function's internal 
control system to at least some of the prescribed standards and 
the vulnerability of the program or administrative function 
itself. The process and results must be documented and a 
fmenclusion reached as to overall vulnerability, e.g., highly 
vulnerable, requiring a detailed review of internal controls; 
moderately vulnerable, permitting less intensive and less fre- 
quent internal control reviews; absence of vulnerability, etc. 
Problems or weaknesses requiring immediate correc- 
tive action may be observed during the performance of the 
vulnerability assessments. Such situations should be brought 
to the attention of the appropriate agency official as soon 
as possible so that prompt corrective action can be taken. 
3. Develop Plan for Subsequent Actions 

Completed vulnerability assessment documents are trans- 
mitted to and maintained by the DON Review and Oversight 
Council which is responsible for the final ranking of programs/ 
functions for DON as a whole. Upon completion of each biennial 
vulnerability assessment, the Council will prescribe a minimum 
number of high vulnerability areas which must be reviewed each 
year. 

Many Similarities can be drawn between these first two 
phases of the internal control review process in the public 


sector with the independent auditor's study and preliminary 
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evaluation of the client's internal control system. Again, no 
specifics are provided and each organization must develop 
procedures useful to its own situation. 
4. Phase 3: Conduct Internal Control Reviews 

DON's ‘instruction describes management control reviews 
(also referred to as internal control reviews) as detailed 
examinations of a program/function to ensure internal controls 
exist, are documented, and are functioning as intended. These 
reviews should identify weak, nonexistent, or exceSsive con- 


trols and initiate actions necessary to correct noted 


deficiencies. Management control reviews are performed at 
mea DON command and activity by the manager responsible for 
Biemsystem Of internal controls under review. The scope of a 


review in a particular program or function should be commen- 
Surate with a unit's responsibility in that area. 

This process is closely related to the procedures used 
by the independent auditor for his limited purposes. 

The following steps provide the basic approach to per- 
forming reviews. 

a. Identification of Transaction Cycles 

If an effective system as previously described 

has not been established, then the processes or events lead- 
ing to accomplishment of a program or function must be 
described. An organization may have a larger or smaller 
number of cycles than discussed depending on its unique 


eieuation. 
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b. Analysis of General Control Environment 

These are the Same general controls mentioned in 
the vulnerability assessment process. If this analysis was 
already a part of a vulnerability assessment, then a review of 
it and update is all that is necessary. 

c. Document Transaction Cycles 

As in the private sector, flowcharts, accompanied 
by appropriate narrative descriptions, facilitate the review 
of current internal controls. Procedures, personnel, and 
documents and records involved should be identified through 
interviews and observation. A walk-through test is advisable 
here too. 

d. Evaluate Internal Controls 

The next step 1s to determine if needed specific 
internal control objectives and corresponding control tech- 
niques are in place for each transaction cycle. 

Control objectives are established because a risk 
exists; internal control techniques are implemented to prevent 
the specific risk from occurring. Pertinent examples have 
been provided in the previous section which discussed the 
establishment of an internal control system. 

Inherent limitations which constrain an organiza- 
tion's effort to maintain an effective system include: budget 
constraints, statutory or regulatory restrictions, staffing 


memrtations, etc. 
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During this step excessive controls should be 
identified, as well as compensating controls -- those which 
offset a weak control. 

Results of this step include an identification 
of necessary internal controls, control objectives for which 
better control techniques are needed, and unnecessary controls 
that may be eliminated, 

e. Test Internal Controls 

This step is similar to the auditor's compliance 
testing. The internal control techniques are tested to deter- 
Mine whether such controls are functioning as intended. Again, 
a review of a representative sample of transactions is recom- 
mended to see whether the general objectives of authorization, 
accounting and asset safeguarding are met. 

During this process, weaknesses and deficiencies 
in the internal control system should be noted and corrective 
actions considered. 

f. Reporting the Results of Internal Control Reviews 

The final step of the internal control review 
process is concerned with the reports which should result. 

(1) Audit Resolution Standard. To comply with 
the Comptroller General's Audit Resolution Standard, the 
results should be reported to managers so they may evaluate 
the findings and recommendations and initiate appropriate 


corrective actions within established timeframes. Reports 
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should contain an identification of weaknesses and recommenda- 
tions to correct them. 

(2) FMFIA Statement. Another provision of the 
Act of 1982 requires an annual statement by 31 December of 
each year, commencing in 1983, from each agency head to the 
President and Congress as to whether the agency has established 
a system of internal accounting and administrative control in 
accordance with the standards of the Comptroller General and 
whether this system provides reasonable assurance that the 
FMFIA objectives are met. 

The collective existence of the below listed 
elements provides evidence that management and other person- 
nel throughout the organization are cognizant of the import- 
ance of internal control and that the necessary evaluation 
and improvement processes are taking place: 


- Responsibility for directing the program is assigned 
to a high level official 


- Agency internal control directives and regulations are 
published and disseminated 


- Documentation of the conduct and results of assessments 
and reviews are maintained 


= Documentation of corrective actions taken to strengthen 
the internal control systems iS available 


= Inclusion of internal control elements in performance 
appraisals 


= Written assurances from both the designated senior 
official responsible for coordinating the agency- 
wide effort and the heads of the agency's various 
organizational units, and comments from the Auditor 
General. 
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The Act also requires an agency to include 
within the statement to the President and Congress a report 
listing identified material weaknesses in internal accounting 
and administrative control and a schedule for their correction. 
A material weakness (Figure 11) is a situation in which the 
designed procedures or the degree of operational compliance 
therewith does not provide reasonable assurance that the 
FMFIA objectives of internal control are being accomplished. 

(3) Report on Agency's Accounting System. An 
accounting system iS an integral part of a management control 
system since the accounting records and related procedures can 
contribute significantly to attaining the objectives of the 
control system. 

Therefore, a separate report is also required 
by the FMFIA attesting to whether or not the agency's account- 
ing system conforms with requirements prescribed by the 
Comptroller General. 

A complete accounting system, for GAO approval 
purposes, is one established to assist in the financial manage- 
ment functions of budget formulation and execution, proprietary 
accounting, and financial reporting. It is the total struc- 
ture of methods and procedures used to record, classify, and 
report information on the financial position and operations 
of a governmental unit or any of its funds, balanced account 
groups, and organizational components. Accounting systems, 


for approval purposes, shall be comprised of the various 
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CONoLDeRATIONS OF MATERIALITY IN THE PUBLIC SECTOR 


A Material Weakness in internal accounting and administra- 
fevye controls is a condition in which the specific control 
procedures or the degree of compliance with them do not reduce 
to a relatively low level, the risk that errors or irregulari-~ 
ties having a significant affect on operations may occur and 
not be detected within a timely period by employees in the 
normal course of performing their assigned functions. [In 
determining what has a significant or material affect on opera- 
tions, a command should consider such factors as the amount of 
assets exposed to weaknesses, the number of times errors or 
irregularities have occurred or a predictable level of occur- 
rence based on historical data, the range and distribution of 
the errors or irregularities, the effect of a combination of 
errors or irregularities on operations, and the quality of 
the overall control environment. 

Judgment must be exercised in deciding whether a weakness 
in internal controls is material. Some common sense guidelines 
include: 

- The dollar amount involved 

- Substantial violations of program directives or poor 

Management that could seriously affect program 
accomplishment 

- Resultant requirements for major policy changes that 

effect monetary or nonmonetary benefits at the DOD 


level 


~ The position and degree of responsibility held by 
persons involved 


Figure ll 
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The number of persons involved 


The existence of extensive minor deficiencies that be- 
come Significant in the aggregate 


The likely degree of impact upon unit readiness, 
security or morale 


The degree of notoriety likely to result 
The existence of a systematic weakness that leaves 


DON vulnerable to recurring problems. 


[Ref. 40] 


Peirce ll icone a) 
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@eerations involving the authorizing, recording, classifying 
and reporting of financial data related to revenues, expenses, 
assets, liabilities, and equity. For each of these operations, 
GAO review for approval will evaluate the procedures and 
processes from the point a transaction is authorized through 
processing of data (either manually or automatically) to 
issuance of financial and management information reports con- 
taining data in detail or summary form. 

2 loc eBurns System 

Romane ss a moment, CAPT J. O. Carlson, Ms. J. W. 
Lewis, and Mr. J. F. Smith, Jr. describe an innovative method- 
ology for the design, maintenance, implementation, and evalua- 
meen Of a network of internal control for accounting and 
financial management systems developed for DON by Dr. D. C. 
Barns . 

The best possible identification of all threats 
against the system is developed. A threat is any adverse 
impact upon the organization that could result from the 
operation of the system. The potential impact of the threat 
1s quantified in dollar terms. Risks, the probability or 
potential of the threat occurring, associated with each 
threat, are then developed and quantified. The identification 
of all possible controls, risk reduction processes or actions 
(internal control techniques), that could apply to the threats 
is performed. These controls may be manual or automated and 


can be internal or external to the system or organization. 


oo) 





The best possible determination of the percentage of effective- 
ness provided by each control against each threat is made, 
recognizing that it is possible for the effectiveness of each 
control to be different for different threats. The benefits, 
the result, in dollar terms, of applying a control against 
each threat, are then determined. This is done by multiplying 
the quantified threat by the risks and again multiplying this 
result by the effectiveness of the control. The result is 
threats, risks, and benefits quantified in dollar terms, 
Begure 12. 

Since controls are threat-specific, the action of all 
controls against a given threat must be developed along a 
Beecitic control path for each threat. This path shows threat- 
specific relationships and control effectiveness, Figure 13. 

The next step is to develop a matrix of threats to 
controls. This shows the possible network of controls for 
the system. The costs of each control are identified, This 
results in the cost benefit relationship of the network of 
controls, Figure 14. Since the Burns System uses a Threat/ 
Control Matrix, the application of the control costs shows 
not only the cost of a control for each threat, but the 
comparison of the cost of that control to the benefits of its 
application against all relevant threats. 

The matrix is then analyzed in one or more of a 
variety of ways. The best possible unrestricted cost bene- 


ficial network of controls, the best network of controls 
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Peo tesCONPONENTS OF THE BURNS SYSTEM 


THREAT PeCON PROG YUNCTION* UNCONTROLLED 
| Rao 


SAS eS / ESTIMATES 


meee AMOUNT OF RISK POSED BY THE THREAT TO BE CONTROLLED 
Y = AMOUNT RISK CONTROLLED 
Z = AMOUNT OF UNCONTROLLED RISK 


fee OPERATING CAPABILITY OF CONTROL TO REDUCE THREAT- 
PavemrtC RESK, EXPRESSED IN PERCENT TERMS 


SeCONSIDERS BOTH 


See TERNAL AND EXTERNAL CONTROLS 
- MANUAL AND AUTOMATED PROCESSES 


Figure 12 


[Ref. 40] 
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EP Grecotel OlNT/PROCESS HAS 
POMOC n wa tum en ON A SPECIFIC’ THREAT 
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under a given cost restriction, or any similar scenario can 
be identified. A variety of sensitivity analysis simulations, 
changing any one or combination of variables (e.g.: risk, 
percentage of effectiveness, etc.) can be performed. All of 
this is expressed in dollar terms, supported by documentation 
produced with automated Support. 

This approach can be useful in the design of cost 
beneficial networks of accounting and financial management 
controls, as well as in the identification and evaluation of 
existing networks of controls. 

It should be recognized that this approach is limited 
to areas of control which can be quantified. It is a less 
useful method for evaluating controls in program and opera- 
tional areas where quantitative data is limited or nonexistent. 
This system reverts to the limited scope of the independent 
auditor's review of financial data and asset safeguarding 
measures. It is not designed to consider the internal admin- 
istrative controls which are also an important part of 
management's concern. However, if OMB & DOD do move in the 
@meeection of focusing on internal accounting controls, this 


methodology will have useful applications. 


eee CONCLUSION 
A point requires consideration here: Is the auditor's 
framework used for the review of accounting controls neces- 


Sarily adequate for the broader emphasis on administrative, 
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moewell as accounting, controls originally intended by OMB 
and DOD? More appropriate guidance should stress the review 
of management controls. 

Again, specific guidance is not provided on how to review 
internal control systems either in the public or private 
@eleor. in large organizations, whether profit or nonprofit, 
broad direction, which must be adapted to each situation, 
makes the coordination and summarization of the nonuniform 


reports into a single, cohesive statement difficult. 
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V. INTERNAL CONTROL - A MANAGEMENT EMPHASIS 


A. Py TRODUCTION 

Both the private and public sector originally accepted 
the broad interpretation of the concept of internal control. 
In the private sector, however, independent auditors success- 
fully limited the scope of their responsibility to internal 
accounting control. Even the AICPA recognized that this 
definition was inadequate for management's purposes since 
corporate executives should be concerned with all of the 
controls contemplated in the inclusive definition of 1949. 

Within the federal government, efforts to establish 
internal control systems have been grounded on CAP's broad 
interpretation of 1949. An attempt has been made to utilize 
the professional auditing literature, originated for the narrow 
Beepose Of internal accounting control, and expand it to 
include program and operational functions as well. Now OMB 
and DOD have revised their definition, moving backwards and 
fem closer to the idea of internal accounting control. It 
is unclear how this revision will affect the establishment 
of an internal control system which covers the entire spectrum 
Sean Organization's functions. But one thing is certain, 
such terminology changes serve to create confusion. And it is 
to be hoped that federal managers will come to recognize their 


concerns can only be encompassed in the 1949 AICPA statement. 
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ID « "INTERNAL CONTROL -- A MANAGEMENT VIEW" 
As part of a larger study on internal control in U.S. 
corporations, Dr. R. K. Mautz and B. J. White wrote an article, 


"Internal Control -- a Management View," which proposes a 


tentative managerial definition of internal (accounting) con- 
trol and briefly attempts to integrate it within the frame- 
work of the Planning and Control process found in organizations. 
Although the writing is addressed to the private Sector, many 
of the ideas are useful for public sector managers, as well, 
and thus will be discussed here. 

Management's interest in internal control: 

.-.- 1s likely to emphasize the positive aspects of internal 
control measures ... (management is) interested not only 

in the prevention of errors and irregularities but also 

in the active accomplishment of the company's objectives. 
The purpose of control is to get things done ... manage- 
ment's interest is more likely to run to activities to 

be performed, resources to be utilized and information 
essential for operational use than would the interests 

of an auditor concerned with the propriety of financial 
Statements for external use. The totality of management 
control is coextensive with company operations. Manage- 
ment's controls are intended to plan, initiate, encourage, 
guide and evaluate the company's activities. Any steps ... 
influencing operations in order to accomplish the company's 
objectives can be included in the total control system. 
(Ref. 44] 

Mautz and White see internal (accounting) control as an 
addition to basic operations -- measures taken to avoid errors 
and irregularities while operations are in progress. Opera- 
tions could continue without internal accounting control, 


although perhaps not as effectively. Without management 


control, however, operations could not exist. 
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These authors view control as necessary to see that: 

- employees perform Certain actions that will have a 
positive effect in accomplishing the company's 
objectives 


= employees do not engage in activities that would be 
dysfunctional in accomplishing those objectives 


— the company's assets are used for the purposes 
intended, and no others. 


Internal (accounting) control makes much of the safeguarding 
of assets. From a management perspective, Mautz and White See 
this concern as less important than utilizing assets in ways 
appropriate to attaining the organization's goals. There is 

a great deal of similarity between the above and Anthony's 
planning and control framework. 

Balance sheet assets are not the only resource to be 
protected from improper use. A company's credit iS a resource 
as 1S its ability to raise funds. Therefore, the authors 
Suggest the use of the phrase ‘utilization and conservation 
of resources’. It avoids the rather sterile protective 
implication of safeguarding and is broad enough to include 
internal control measures for liability and equity items as 
well. 

Management has a dual control problem with information. 

It must assure an adequate supply of reliable, timely informa- 
tion to the members of the operating management ... Management 
also has a responsibility to maintain its access to the 
capital market and ... to meet legal requirements by issuing 


interim and annual financial statements ... auditors tend 
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BoOwchink Of Internal control as concerned primarily with this 
external financial reporting. 

Mautz and White next propose a conceptualization of 
management control with ideal employees: assume a set of 
conditions in which management need have no concern for 
internal errors or irregularities since all employees are 
efficient, prudent, honest, loyal, informed, and none are 
susceptible to lapses of any kind. With essential instruc- 
tion and guidance, they are competent and serious in attempt- 
ing to perform in accordance with company policies, objectives, 
and plans. In such a situation, the elements of a management 
control system would include only control measures essential 
to operations: 

= establishment of objectives (policy) for the company 

and its operating components (conventional function 
of the board of directors) 


= communication of objectives to those responsible 
for implementation 


- implementation (management function) 
= Planning operations to achieve objectives 
= Instructing employees about expected performance 
- Performance 


~ Review of accomplishment and consideration of need 
for modification of plans and policies. 


The authors suggest additional elements since employees 


are human and subject to faults and failings: 
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- Supervision to provide reasonable assurance that 
employees: 


- perform the activities for which employed and 
do not undertake actions detrimental to the 
accomplishment of stated objectives 
= utilize and conserve the company's resources 
= provide an adequate supply of reliable, timely 
information for internal management purposes and 
prepare periodic financial statements. 
To ensure employee failure does not occur, Mautz and 
White suggest specific practices and procedures tailored to 
a company's activities which would be included in the manage- 


ment control system: 


- Establishment of objectives for the company and its 
operating components 


- Communication of objectives to those responsible 
for implementation 


= Implementation 
= planning operations to achieve objectives 
- instructing employees on performance 
= performance, including supervision of performance 
- Utilization of precautions, incentives, and deterrents 
to reduce the probability of errors and irregularities 
and of measures to detect the existence of errors and 


irregularities if these have occurred 


= Reviews of accomplishments and consideration of the 
need for modification of plans and policies for: 


- effect of outside forces 


= any action needed to reduce the probability of 
internal errors and irregularities. 
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Thus, internal (accounting) control measures fit within 
the management control system and become a part of it once 
the assumption that employees are subject to errors and 
irregularities is accepted. 

Mautz and White define internal (accounting) control as ... 
those measures employed by management to attain the objectives 
of the enterprise that would be ereees sai if all personnel 
were competent and trustworthy ... measures to remind per- 
sonnel ... of their duties, to encourage efficiency, prudence, 
loyalty, and to provide for timely discovery of errors ... 

Internal (accounting) control is recognized as part of 
the total management control system -- measures employed by 
management to obtain the objectives of the enterprise. It 
constitutes an identifiable subset of these measures. At 
the same time, the proposed definition does not encompass any 
part of policy formation (strategic planning) or operational 
planning (operational control). 

Finally, Mautz and White state that although it is separate 
from policy formation and operational planning, internal 
(accounting) control leans heavily on these elements of 
management control for meaning. It could not be evaluated 
effectively all by itself. Unless policy goals in the form of 
reasonably specific objectives are known, there can be no 
measures to attain them. Unless operating plans exist, 
Supervision of performance loses its meaning. Internal 


accounting reports must recognize that both objectives and 
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plans to achieve them (internal administrative controls) are 
highly relevant to the purpose of reporting, and from a 
management viewpoint, one aspect of external reporting is to 


show how well the company has met its objectives. 


C. DOD'S PLANNING, PROGRAMMING, BUDGETING SYSTEM (PPBS) 

The Department of Defense (DOD) utilizes a similar system 
of planning and control based on Anthony's framework. The 
system is grounded upon an assessment of strategic goals and 
requirements and the quantification of these requirements into 
budgetary vehicles, following much the same process as des- 
cribed in Anthony's management control process presented in 
Chapter III. Summarized, this Planning, Programming, and 
Budgeting System (PPBS) is based on the anticipated threat; a 
strategy is developed to counter the threat; requirements of 
the strategy are then estimated; programs are developed to 
Beeteage and execute the strategy; and finally, the costs of 
approved programs are budgeted. 

1. Planning and Programming 

The concept of planning within the DOD is meant to 
fulfill the same role as strategic planning in Anthony's 
framework. Much as a corporate Board of Directors sets the 
broad goals and objectives of the corporation, goals and 
requirements of the DOD are set by high level bodies, such as 
the Joint Chiefs of Staff, the National Security Council, 


and the Secretary of Defense, which analyze the threat to the 
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national defense under varying scenarios. These threat 
analyses are viewed over long timeframes (10 years or more) 
considering numerous factors and are published in the Joint 
Strategic Planning Document (JSPD). From the JSPD, the 
Secretary of Defense, as the Chief Executive Officer of the 
DOD, issues his Defense Guidance, which translates the threat 
requirements into guidance for preparation of the Program 
Objectives Memoranda (POM). 

The basic purpose of the programming phase of the 
PPBS is to translate the strategy into the program force 
structures in terms of time-phased resource requirements, 
including personnel, funding, and material. Most of the 
emphasis within the DOD and the Services is devoted to develop- 
ment of the weapons systems determined as required to meet 
the threat, rather than analysis of the threat itself. Fur- 
ther, as the "threat" or "strategy" is less than a quanti- 
fiable set of terms, and as the threat is described over a 
long-term future basis, there is really no firm method to 
evaluate the developed threats in retrospect. Hence, 
comparatively little emphasis is placed on the planning phase. 
This has resulted in the phrase "Planning, the silent 'P' 
in PPBS." 

The POM expresses the total requirements of each of 
the Services in terms of force structure, manpower, material 
and costs, to satisfy all assigned functions and responsibil- 


ities during the period of the Five Year Defense Program (FYDP). 
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These requirements are expressed in terms of specific programs 
within the FYDP, and each of the programs is assigned a 
specific numerical code, the Program Element Number (PEN). 

The PEN becomes a vehicle by which the programs may be tracked 
from the development cycle through execution. 

Each of the Services submits its POM to the Secretary 
of Defense and the Joint Chiefs of Staff for review and | 
eventual approval. The Secretary's review/approval is in the 
Form of Program Decision Memoranda (PDM), which direct the 
respective service to make an adjustment to a specific program 
within its POM. The Service's POM, as adjusted by the various 
PDMs, becomes the guidance to the Service for budget 
development. 

2. Budgeting 

The ultimate purpose of the PPBS is to develop the 
DOD input to the President's budget, which is submitted 
annually to Congress in the January timeframe. The budgeting 
phase, however, 1S more than a mere resubmission of the POM 
as the budget to Congress is in appropriation format, while 
the POM was in program format. This becomes a somewhat 
difficult task as each program utilizes funds from various 
appropriations, such as Military Personnel, Procurement 
appropriations, and Operations and Maintenance. The PEN, 
previously described, becomes a key element in crossing 


programs to appropriations and back. 
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Often overlooked in the management control require- 
ments of the DOD is the time-phasing of budget development and 
budget execution. Budget development, including the planning 
and programming phases, is- being accomplished at the Service 
headquarters level a year in advance of the President's 
budget submission to the Congress. Thus, requirements for 
FY-85 will be submitted to the Congress in January, 1984. 
These requirements were developed over the course of calendar 
year 1983. However, budget execution is performed at the 
activity level, but budget development emphasis at the activity 
level is for the next fiscal year. That is, in the spring 
and summer of 1983, the activities are critically evaluating 
their budget requirements for FY-84. While most activities 
are required to identify needed resources for FY-85 at the 
Same time, this effort is less than critical in the minds of 
activity personnel; FY-84 is the most important. 

Thus, while the PPBS has the wherewithal to be a 
powerful management control system, the sheer magnitude of 
the DOD and the long-term (2 years ahead) budgeting require- 
ments, a break in the management control system exists 
between the Headquarters levels and the activity levels. 

3. Budget Execution 

Resources are allocated to activities based upon 
their identified needs, and based upon the funding approp- 
riated by the Congress. At this point, a further separation 


of requirements occurs, as funds are passed along 
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organizational lines. Previously we witnessed requirements 
identified along program lines, converted to appropriation 
lines, and now being segregated by activity lines. Save for 
the program element number (PEN), tracking, for evaluation 
and control purposes, from requirement in the POM to final 
accounting of the funds, becomes tantamount to impossible. 
It should be noted that during execution, costs are aggregated 
by organization and by program in preparation for reports to 
managers outside the immediate organization. There is 
basically no structure for maintaining information useful to 
managers in the continuing operation of their organization. 

Large commands do maintain an internal audit staff 
to ensure resources have been employed effectively and 
efficiently and within legal and administrative constraints. 
In the past, there has been little emphasis on preventive 
administrative and accounting controls which would lessen 
the need for the detective function of internal audit. 

4. Review and Evaluation 

As the stated purpose of the PPBS is the submission 
of the President's Budget, PPBS does not focus a great deal 
of attention on the area of review and evaluation. Activi- 
ties do attempt to avoid the hazards of RS 3678 and 3679 
violations and financial, compliance, economy and efficiency, 
and program audits are done on a relatively regular basis 
by all levels of audit agencies. However, the institution- 


alized coordination and control activities focus on meeting 
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the requirements of outside managers, rather than the internal 
needs of local managers; operational managers’ performance 
Seeelaelons £OCUS primarily on the level of attainment of 
mission objectives rather than on budgetary performance; 

and programs are reviewed at very high levels with rare 
involvement of personnel at the activity level. Thus, the 
review and evaluation processes at the activity level are 
more closely related to operational or internal accounting 


controls than to management controls. 


pee CONCLUSION 

Both the private and public sector are capable of estab- 
lishing a basic structure for the application of management 
control. However, in reality, the public sector's execution 
is so far removed from the long-range planning process and 
the span of operations is so great that overall control is 
next to impossible to attain. Therefore, form has tended to 


be accentuated over substance in the public sector. 
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Vile CASES 


a) 6ULLNTRODUCTION 

Since an example is worth a thousand words, a number of 
representative cases which illustrate the problems and risks 
of accepting the narrow definition of internal accounting 
control will be illustrated 1.. this chapter. Some are drawn 
from the private sector and others are from the public sector 
but managers in either arena can relate the discussion to 


their own organization. 


Eee RLVATE SECTOR 
i Wily Wilby 

This case [Ref. 45] relates the story of a man with 
an established history of embezzlement in Canada and the 
United States. Each previous instance had provided a learn- 
ing experience for him. 

The main story revolves around Wilby, alias A. D. 
Hume, whom our man had met by placing a bogus classified 
advertisement in a trade journal. When the real Hume de- 
Beeea for military duty during World War II, Wilby took 
his credentials to a New York employment agency which 
Specialized in CPA's. Despite the fact that the head of 
the agency knew the real Hume slightly and realized the man 
before him bore no resemblance to him the embezzler rose 


above that and was sent on an interview. Hume's impressive 
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credentials were verified and Wilby gained a new position 

aS an accountant with the William T. Knott Company, a 
management corporation for a set of department stores which 
ordered and received their own merchandise and forwarded the 
invoices on to the parent company for payment. 

The Knott Company averaged $40 million in disburse- 
ments per year for which the company felt it had a foolproof 
accounting system. Invoices were carefully compared with the 
purchase orders. Accountants, clerks, typists, and standard 
business machines took the approved invoices through a lab- 
yrinth bookkeeping system at the end of which checks emerged 
ready for Signature by a check-signing machine prior to mailing. 
This machine was complicated and mechanically above reproach. 
Only a few personnel had access to it and only after the 
proper, secret perforations and notches had been made on 
certain unmentionable pieces of cardboard -- one for each 
invoice -- would the machine sign a vendor's check. When the 
Special machine was not working, important pieces of it were 
locked up in different corners of the same accounting office. 

Wilby progressively advanced in the company from 
traveling accountant to home office accountant with no 
defalcations. He was next named chief accountant at $6000 
per year and was now in a position to make a fortune. 

During the first year, Wilby took $110,936.81 which 


wasn't missed by the company and was not revealed in the 
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audit. During this timeframe, he was not above taking a 
personal interest in the business machines, often dazzling 

the operators by diagnosing their machine's difficulties after 
a shrewd glance and some sympathetic fingering. At the end 

of the year, he received a $500 bonus and was named assistant 
treasurer. 

During the next year, he took $275,984.43 and received 
another year-end bonus. 

Wilby and his wife lived modestly; he saved some of 
his earnings and all he stole was conveniently available in 
local New York banks. 

As chief accountant, Wilby was tied to his position, 
bringing office records home each evening to work on and tak- 
ing business trips almost every weekend. 

Emtec =beqimnang or His third year in the position, 
Wilby asked for a short vacation to take his wife skiing in 
Canada. Since the previous year's accounts balanced and all 
was under control, the request was granted. 

When Wilby was due to return, the Knott Company 
received a telegram stating that the man had broken his leg 
and would be detained -- no location was provided in the 
message. 

After unsuccessful efforts to find him, the company 
realized its problem and called in the auditors. They dis- 
covered that the withdrawals from the Knott account were 
much higher than the total of the cancelled checks and that 
a number of the cancelled checks were missing as well. 
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The embezzler's scheme had been accomplished without 
difficulty. When the daily mail arrived, it was easy to 
intercept several envelopes, change the value and name on 
the original invoices, add a second invoice which duplicated 
the store's submission, and then adjust the control totals; 
another approach was to-insert bogus invoices for his own 
vendors and use the secret pieces of cardboard to process 
them through the standard business machines. Wilby had rented 
office space where the checks were mailed for arrival on the 
weekend. On his weekend business trips, he would make sure 
to deposit them promptly ina local bank for later transfer 
to the same bank branch that was used by the Knott Company in 
New York. 

When a Toledo bank checked the references of G. B. 
Towle, one of the ficticious vendors, "Hume" assured it that 
Towle was a legitimate businessman in the advertising line. 

When D. True, an accountant at the Butte, Montana 
store, raised questions about certain suspicious freight 
Sweamges debitted against the store, the Knott Company treas- 
urer referred his inquiry to "Hume." In his written response, 
the investigators found a clue as to how the scheme had 
worked. By tracing the freight charge through the accounting 
system, they discovered how the books balanced in spite of 
the defalcations. The stolen money was charged to the depart- 
ment store and deftly distributed among the stores in 


different ways and with shrewd knowledge of which accounts 
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could stand being raised a bit here and there so that the 
stores wouldn't notice. 

When the auditors did their yearly review of the books, 
the embezzler had allowed them to add all the bank statements 
and the cancelled checks, including the ones he had endorsed 
himself, with the result that the withdrawals from the Knott 
Company bank account tallied with the total of the cancelled 
checks. Then he had destroyed the cancelled checks he had 
endorsed and had altered entries in the books, so that, in 
effect, what the Knott Company had lost to him it got back 
from the stores, in the form of debits against the stores' 
accounts. The investigators wondered why Wilby had departed 
so suddenly since if he had followed through for the current 
year, he would probably never have been discovered. 

As a protective procedure, companies bond their 
employees. Because the insurance company which had bonded 
Wilby had a large investment in the case, he was pursued 
euragently. 

It was easy enough to find the real Major Hume and 
realize he did not meet the description of the embezzler. 

Old bank records revealed one of the few careless 
mistakes of the imposter. When he had purchased a bank draft, 
Wilby had originally requested that it be made out to his 
real name. Then he had changed his mind and named Hume as 
the payee. This was all the police needed to trace Wilby's 


fmeeena and photographs. 
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After finally apprehending Wilby, the Knott Company 
was satisfied the embezzler had no human accomplices but the 
Standard business machines were criticized and newly devised 
safeguards were added to them. 

The Federal Bureau of Investigation (FBI) proved to 
be the reason why Wilby had left the firm so abruptly. At 
the time this case was occurring, the mid-1940's, the PBI 
was investigating German names, specifically one F. B. Hecht, 
who the agency was convinced was a Nazi Fifth Columnist. 
feeme had beén one of Wilby's ficticious vendors and the 
local St. Louis bank provided "Hume's" name as a reference 
to the agency. He provided them misleading information but 
the agency continued to pursue the issue so Wilby did not 
wait for the approaching showdown. 

Although currently considered a statutory felony, 
at the time of the Wilby case, embezzlement was not generally 
considered a crime against the people and perpetrators were 
often given suspended sentences or short prison terms if they 
made restitution. 

However, the judge in this case felt that if Wilby 
was given a lenient sentence, he would be foolish if he 
didn't continue to embezzle. So the judge sentenced him to 
from five to seven years in Sing Sing and requested his 
deportation at the completion of the prison term. 

SSmmuchmior the W. T. Knott Company’s foolproof 


system! A review of the factors that shaped the internal 
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accounting control environment shows just how easy they were 
Eemcircumvent in this particular situation. 

Wilby understood the processes of the accounting 
system, the duties of its personnel, and the intricacies of 
the standard business machines so well that he was able to 
effectively manipulate all the peripheral clerical and 
administrative procedures surrounding it. Even though the 
books were in perfect balance when audited (reliable finan- 
Cial records) and the company did not notice any missing 
funds (safeguarded assets), the true picture indicated that 
there was little operational effectiveness or efficiency 
or little adherence to managerial policies (internal adminis- 
trative controls). And so in the final analysis the account- 
ing controls were inoperative as well. 

A more thorough investigation of Wilby's credentials 
should have been completed by the employment agency especially 
Since the director knew he was not dealing with the real 
Hume. 

The Knott Company was disarmed by the apparent out- 
standing performance and charming personality of their wily 
employee. The firm should have been a bit more aware of the 
internal control mechanism of separation of duties; rather 
than relying on the convenience of an in-house repairman, 
vice the expense it should have employed a disinterested 


serviceman. 
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Wilby was able to rise smoothly above the few ques- 
tions that were raised. As stated in the original case 
ae such strange things have happened that we cannot count 
on anything." 

This case demonstrates the value of personnel who 
raise critical questions. It is a matter of judgment whether 
to pursue such information but the Knott Company could have 
benefitted if it had not placed such faith in its employee. 

Ze eneeckwe lil mncernatriond! Corporation 
Rockwell expected to save a lot of money by leasing 

computers from third parties rather than buying or renting 
them from manufacturers. 

Instead the company became a victim in the computer- 
leasing fraud carried out by OPM Leasing Services, Inc. 

A recent court-ordered investigation has revealed 
that poor financial and management controls made the company 
an easy mark. 

The practices which facilitated the fraud included 
the following: 

-~- Rockwell's lawyer in charge of computer leasing 
allowed his secretary to keep a stack of pre-signed 
legal opinions that sometimes were attached to un- 
read leases ... Rockwell officials also didn't 
attend lease closings and thus wouldn't be able to 
notice when documents had been doctored or switched. 

-- Bad record-keeping hurt the company too. Officials 
often didn't keep track of lease documents, make 
copies, or note when papers were missing. Thus 
Rockwell had no way to determine whether computers 


listed on a particular lease presented by OPM for 
execution had already appeared on a prior lease 
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which happened in some cases. That allowed the 
swindlers to fraudulently secure bank loans for 
equipment never bought or delivered to Rockwell. 


-- Leases often specified payments were to be sent 
directly to the banks that had financed the computers. 
Instead, Rockwell often paid OPM with the belief the 
money would be forwarded to the bank. OPM, however, 
frequently missed the payments. Disregarding direct 
payment obligations facilitated the fraud and dero- 
gated the legal rights of the financing institutions. 


-- Rockwell apparently suspected that management of its 
computer leasing wasn't as tight as it could be. 
Internal audits in 1979 and 1980 concluded too much 
responsibility was concentrated in the hands of the 
director of computer planning and his role was re- 
duced but he continued to help OPM land most of the 
computer leasing contracts despite Rockwell's growing 
reservations about OPM's honesty and financial 
soundness. 


-- Rockwell's chief financial officer ordered an examina- 
tion of OPM's financial statements to determine the 
company'sS soundness. Mr. Goodman of OPM gave Rockwell's 
treasurer a bogus financial statement. He testified 
that Rockwell's director of computer planning had told 
him not to worry about the financial review since the 


treasurer ' ... doesn't understand financial state- 
ments anyway, so you can double talk your way around 
it. And you should have no problem.' This was an 


accurate prediction since the treasurer did not 

notice the absence of a date on the auditor's report 
or the inadvertent inclusion of cash and marketable 
securities in the receivables subtotal. He focused on 
net worth, finding the grossly inflated $44.9 million 
figure satisfactory. 


-- Rockwell officials learned in 1980 that the OPM 
Swindlers had pleaded guilty to check kiting charges 
in a separate matter but the company continued to 
conduct buSiness with OPM until 1981. 

Rockwell has denied that its management, record- 
keeping or financial controls contributed significantly to 


the fraud but the company has agreed to adopt new leasing 


mites requiring: top officials to approve all third-party 
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leases; the company to keep lease documents and copies in 

a central filing system and make lease payments only to the 
people who are supposed to be paid; company lawyers give an 
Opinion about proposed lease contracts and be present when 
they are signed. [Ref. 46] 

It is clear that failure to follow established poli- 
cies and guidelines, inattention to detail and ineffective 
management oversight greatly contributed to this fraud. Such 
concerns are related to internal administrative controls but 
have the potential to generate large financial losses. 

Better management controls in the following areas 
could have prevented this fiasco: a more careful selection 
of qualified and trustworthy personnel, more formal legal 
procedures, more rigid recordkeeping, and tighter financial 
administrative controls. 

The narrow range of internal accounting controls 
fails to recognize the importance of such concerns as adher- 
ence to management policies or operational effectiveness or 
efficiency. This case illustrates the tremendous losses, 
estimated at $600 million which can be suffered by a company 
which fails to focus enough attention on the enforcement of 
internal administrative controls. 

3. General Dynamics 
A federal grand jury indicted two former General 


Dynamics executives for receiving kickbacks in connection 
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with construction of ligquified natural gas (LNG) tankers and 
Navy nuclear submarines. The two named in the indictment 
were P. Takis Veliotis and James H. Gilliland. 

The indictment states the kickbacks were arranged 
through Frigitemp Corporation, a General Dynamics subcontractor 
which provided Hirer tomerrxtunres and) Insulation for ships. 
Frigitemp was declared bankrupt in 1979 but its subcontracts 
were transferred to another company so the scheme could 
continue. A vice president and the chairman and chief execu- 
tive officer of the subcontractor were also indicted for 
arranging and making the kickback payments. 

The kickback scheme began in 1973 and 1974 when 
Frigitemp realized that kickbacks to Veliotis and Gilliland 
would ensure winning the subcontracts. As ten of the LNG 
tankers were built, Frigitemp received more than $44 million 
in subcontracts. The awards were made: in one instance even 
though the shipyard's purchasing department had recommended 
a previous bidder; in another instance, even though the time 
Specified for the receipt of bids hadn't expired. 

Funds for the scheme were generated by having Frigi- 
temp pay for non-existent consulting services and raw 
materials. These costs were passed on to the prime contractor 
who in turn passed some of them on to the federal government. 

When subcontracts were awarded to Frigitemp for two 


of the tankers, shipyard employees protested that the bids 
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submitted by the subcontractor were far in excess of competing 
bids. [Ref. 47] 

Despite the facts that: adequate procedures were 
established in the area of contract administration; shipyard 
employees protested the awards, and the Navy questioned cost 
overruns, management was able to render the controls 
ineffective. This case illustrates the limitations of inter- 
nal controls when management colludes and overrides them. 

It also shows the value of fostering a critical attitude 
among employees so that they may bring concerns to management's 
attention. 

4. Touche Ross 

A Wall Street Journal article [Ref. 48] states that 
the SEC recently charged one of the “Big Eight" auditing 
firms with failure to examine the company's financial state- 
ment in accordance with generally accepted auditing standards. 

The surface shipyard signed contracts worth $3 
billion to build destroyers and helicopter carriers for the 
Navy. For several reasons, including blunders in production, 
the contractor's expenses began ballooning. Rather than 
recording the burgeoning expenses as losses when incurred, 
the company deferred them in the hopes that the Navy would 
pay the extra bills. 

The SEC said that the auditing firm should not have 
acquiesced to the contractor's deferral of the losses. 


Although the auditor had issued qualified opinions subject 
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to uncertainties over the dispute, the SEC stated that the 
auditing firm should have known that the contractor was 
unlikely to escape without losses and therefore, should have 
recommended that the company recognize at least some of the 
losses earlier. Further, the SEC felt that the auditor should 
have challenged management about the contract losses. 

The contract dispute ended in 1978 with the company 
accepting a $200 million loss on Navy work. 

Although this article primarily addresses the fair- 
ness of the presentation of financial statements and thus 
1s closely tied to internal accounting controls, it also 
indicates that management's failure to deal with problems 
in program or operational areas can quickly be translated 
into financial ones. Even if controls as established are 
adequate, failure to follow them negates their value. 

This particular case also raises concerns about 
the apparent willingness of audit firms to accept manage- 
ment's views without maintaining a healthy skepticism or 
exercising the professional judgment gained through numerous 
audits. 

5. Itel 

Another Wall Street Journal article [Ref. 49] dis- 
cusses a court-ordered examiner's report that asserted Itel's 
collapse was caused by decisions of top management and the 
Failure to act by the company's outside lawyers, auditors, 


pme@eairectors. 
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'There was substantial failures by the company's 
management and legal counsel to make full disclosures of 
Significant facts and developments' and the auditing firm 
‘breached its contractural duties to perform an adequate 
audit' and to inform the company's directors of the serious- 
ness of its weaknesses of internal controls. 

The central cause of these breaches was the dominant 
Management style of the company's president who believed that 
controls would 'stifle entrepreneurship' and threaten the 
'ambience' of the company. 

As a result, the company's management style and 
attitudes, weak internal controls, major business problems, 
and heavy debt combined to force the corporation's financial 
Betlapse in 1979. 

The report said that its 'criticism of outside 
directors related not to improper actions but to their lack 
of actions. They did not conduct the kind of oversight 
function one might have expected.' 

PenaelLy,esne EepOrt Stated that the 1978 and 1979 
financial statements 'contained materially false and mis- 
leading information.' 

This case illustrates what can happen when manage- 
ment control and internal accounting and administrative 
controls are not enforced or are nonexistent. 

The last two cases dealing with the private sector 
are extracted from Professor San Miguel's forthcoming 


Meek. |Ref. 50] 
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6. Penn Central Transportation Company (PCTC) 


One of the largest mergers in industrial history (in 
terms of assets) was the marriage of the Pennsylvania Railroad 
and the New York Central Railroad in 1968. Two years later, 
the combined entity became one of the largest bankrupt 
organizations in history. Some of the reasons listed for the 
collapse include a lack of flow forecasts, lack of a costing 
system, creative accounting, lack of budgetary control, and 
improper asset valuation. More specifically, management 
Beeersectly charged operating expenses to capital, allowed 
the crediting of uncollectibles to income, recognized gains 
on the transfer of assets from one subsidiary to another, and 
made loans to subsidiaries and then recorded the cash flow- 
ing back to the parent company as dividends. One analyst 
commented that these practices turned a $95 million actual 
loss in 1969 into a reported profit before extraordinary 
items of $4.4 million. Such practices are intentional per- 
petrations by management and it is doubtful that any internal 
control system could have prevented them. 

However, other unintentional deficiencies in internal 
control appear to have contributed to the collapse. Evidently, 
PCTC operated filthy trains on rails in serious disrepair. 
Service was very poor with trains often missing scheduled 
arrivals, Apparently, an employee and management performance 
evaluation system was not in place to prevent such poor 


business practices and supervision. These matters related 
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to operational efficiency and managerial policies, administra- 
tive concerns overlooked by the narrow definition of internal 
control. In addition to lack of management communication 
flowing down into the organization, an inadequate management 
information system prevented proper information from flowing 
up to management. Just prior to collapse, the Department of 
Transportation requested a cash flow forecast in response 

to the company's bail-out request to the federal government. 
However, no such forecast was forthcoming due to the inadequate 
records. Ironically, 17 members of the board of directors 
were bankers. On June 21, 1968, PCTC ran out of cash and 
filed for bankruptcy. 

Although internal controls might not have prevented 
management's manipulation of accounting policies, they might 
well have prevented cash insolvency. Preparation of a state- 
ment of sources and uses of cash for 1962-67 would have 
shown: 


SOURCES AND USES OF CASH 
Genie icone >) 


Sources: 
Rail Income 
Non Rail Income 


S$ 380 
Soo 
7310 
Uses: 
Interest 200 
Dividends 25.0 
Capital Expenditures 1200 
1850 
S191 20 


Decrease in Cash 
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It appears that periodic preparation and review of 
cash flow forecasts would have highlighted the significant 
cash outflow and future cash shortage. Also, it would appear 
that the board of directors did not inguire into the cash 
flow situation until it was too late. Since such information 
plays a vital role in the safeguarding of assets (especially 
cash), it qualifies as an element of internal accounting 
control. In the case of PCTC, this element was seriously 
feaeking. 

ieee 1. Grant 

Unlike the bankruptcy of Penn Central, the public 
was not surprised by the failure of W. T. Grant. The finan- 
cial papers regularly printed stories concerning this 
retailer's financial woes during the year prior to bankruptcy. 
The 1973-74 recession served to accelerate the company's 
decline and brought about its financial death in 1975. 

Analysts have cited these reasons for failure: an 
Overly aggresSive expansion program (612 new stores between 
mes and 1973), lack of uniformity among stores, lack of 
management skill and merchandising focus, excess inventory 
due to a wide product line, and a switch to a cash draining 
revolving customer credit program. To fund the expansion 
program, management raised debt inflating the company's 
debt/fequity ratio to .7 in 1972 (one of the highest ratios 


of any major merchandiser). Additionally, the company paid 
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out dividends on common stock in fiscal 1973 and 1974 equal 
to 1283 of the earnings available to common stockholders. 
The high interest rates and credit crunch of 1974, combined 
with the cash strains inflicted by EMAC STONE, were suf- 
ficient to squeeze the last drops of liquidity out of the 
company. er Signs of failure existed long before the 
insolvency. Sales per square foot ranged between $32 and 
$35, less than half of the rates obtained by Grant's 
competitors. Poor store site locations were cited as a 
contributing factor to the sales volume falling below those 
of competitors. Between 1968 and 1972 Grant's sales increased 
50% because of the numerous new stores opened but earnings 
remained flat. 

The Grant's failure does not appear to be primarily 
due to weak internal accounting controls (as narrowly defined) 
but to weak administrative controls. A close monitoring and 
forecasting of cash flow and policies to retain cash would 
have helped maintain Grant's liguidity. Consistent with 
steps to protect liquidity, slower growth and efforts to 
increase the profitability of existing stores. Such considera- 
tions are not encompassed by the narrow definition of inter- 
nal control yet are basic to the interests of investors, 
creditors, and employees, suppliers, and others who must 


suffer the consequences from such a Significant bankruptcy. 
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Although the W. T. Grant's litigation is not yet 
completed, serious questions have been raised concerning the 
adequacy of controls over accounts receivables and inventories. 
When compared to the control systems used by other large 
retailers, the internal controls for Grant's receivables and 
inventories were deficient. Also, the company had a very 
small internal audit staff. These allegations of inadequate 
internal controls are more related to the narrow concept of 


mmieerhal accounting control. 


fee OBLIC SECTOR 
im Introduction 
The Defense Audit Service has provided examples of 
adverse conditions due to weaknesses in internal control. 
This sample of cases will focus on administrative controls 
primarily but will mention some illustrations which deal with 
accounting controls as well. This approach is used to show 
that within an organization the controls which encourage 
operational effectiveness and efficiency and the adherence 
to managerial policies and procedures provide a framework 
within which to integrate internal accounting controls. 
2. Separation of Duties 
The lack of separation of duties resulted in the 
embezzlement of almost $2 million over a 3-year period from 
the DOD Civilian Health and Medical Program of the Uniformed 


Services (CHAMPUS). The program pays non-Government 
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hospitals and doctors for the medical care of eligible 
military personnel and their dependents. Because of poor 
internal controls, a civilian program administrator was 
allegedly able to embezzle funds by preparing and certifying 
over 3,300 phony medical claims. The administrator was 
Peeronsible for processing and approving all claims received 
under this program. 
be Gaysical Beeurity 

Imprest funds were often exposed to the risk of loss, 
theft or misuse because not all agencies were adequately 
controlling, safeguarding or managing millions of dollars in 
such funds. One fiscal office that was not following GAO 
and Treasury requirements to safeguard funds lost about 
$209,000. The office kept its imprest funds in an unlocked 
cashbox stored in a safe which was accessible to several 


people other than the cashier. 


4. segregation of Duties Involving Government Transporta— 
tion Requests (GTRs) 


In many locations GTRS were susceptible to conversion 
for personal use because of inadequate safeguards and 
controls. These documents are issued to Federal employees 
to be used in place of cash to pay for travel on official 
business. Over a 2-year period, an employee at one location 
converted several GTRs, amounting to more than $30,000, for 
personal use. He was able to do this because he had total 
control over acquiring, maintaining, issuing and accounting 


for these easily convertible documents. 
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Seoayecoll Control 

Payroll preparation, processing, distribution and 
related activities are common areas of fraud, waste and abuse. 
False statements on time and attendance documents are a 
most frequent problem. In one case, a Government employee 
was responsible for maintaining time and leave records and 
sending the information to the agency's central payroll 
office. The individual added fraudulent overtime hours to 
her own payroll data before sending it to the payroll office. 
This same individual distributed the payroll checks. The 
fraud was detected because the timekeeper was absent ona 
day when the payroll checks were received for distribution. 
Her supervisor distributed the checks and noticed the time- 
keeper waS receiving excess pay. The individual received 
$3,200 in fraudulent overpayments before being caught. 

Se Personnel Control 

False statements on employment applications are the 
most frequently encountered problem. For example, several 
DOD cases involved the fraudulent enlistment of illegal 
aliens into a military service. The aliens enlisted by 
presenting false birth certificates or other false proof 
of U.S. citizenship. In another case, a recruiter, under 
pressure to fill his guota of enlistments, allegedly en- 


couraged a recruit not to disclose his police record. 
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PeoeneontLol OL foreign Military Sales 
Unfunded civilian personnel retirement costs were 
not billed to FMS overhaul and repair cases because the repair 
Facilities performing the overhaul were not including a charge 
for unfunded civilian retirement. This situation occurred 
because implementing instructions had not been issued to 
repair facilities requiring the inclusion of 13.4 percent 
for unfunded civilian retirement costs. At least $566,000 
was not charged to FMS customers during FY 1979 for unfunded 
Civilian retirement. 
fee control of Support Services 
Office furniture was not accounted for and was subject 
to theft or misuse. Records were not maintained to identify 
miemauantity or the condition of furniture turned in for 
storage. Documentation was not available to support furniture 
disposals. After furniture was issued from the stock fund, 
no further accountability was maintained. 
9. Adequate Documents and Records 
A naval air station found that a SERVMART was not 
returning a copy of the SERVMART Shopping List (NAVSUP Form 
1314) to the ordering unit/command, setting up the possibility 
of the ordering of unauthorized/unnecessary items/quantities 
of material. 
10. Authorization Procedures 
A naval air station found a lack of internal control 


over the receipt, issue, and recording of small arms 
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ammunition being passed from ordnance personnel eG) eel erie Leal tay, 
units. 73,000 rounds were determined to have been issued to 
personnel who were either not authorized to requisition the 
ermunbelon, Or not authorized to receipt for or pick up 
ammunition. Also there was no separation of duties for 
receipt, issue, and record maintenance functions performed 


by ordnance personnel. 


Dee CONCLUSION 

In assessing these cases which span approximately forty 
years, consideration should be given to what has been 
learned. 

In the 1940's, Wily Wilby effectively manipulated the 
"foolproof" accounting system of the Knott Company because 
of the company's lax administrative and clerical procedures. 

Despite the fact that business firms and governmental 
agencies have institutionalized the audit function, both 
internal and external, and recently passed legislation has 
attempted to ensure the establishment of adequate systems 
of internal accounting control in both the private and public 
sectors, current examples indicate that such a narrow em- 
phasis does not ensure a well-managed (controlled) business 
or necessarily lead to attaining the goals of safeguarded 
assets and reliable accurate accounting records. 

Management should focus, instead, on the intertwined 


administrative and accounting controls which together lead 
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to effectively and efficiently attaining program and opera- 
tional objectives, as well as financial and administrative 
ones. 

Yet, the picture presented is not quite so bleak. A 
final private sector case is presented illustrating a 
recognized system of internal control. It should be kept 
an mind that this example focuses on the commercial sector's 
performance measures of profit and loss and that each 
organization is unique and its internal controls must be 
adapted to that situation. Even so, much can be learned 
from this presentation. 

Perec enartonal Telephone and Telegraph Corporation (ITT) 

This discussion will center on the sections of a case 
[Ref. 51] which deals with the establishment and operation of 
ITT's Business Plan. The reader should keep in mind DOD's 
PPBS budget process as well as Anthony's Management Control 
framework as he or she proceeds. 

ITT attributes much of its success to an extensive 
system of financial reports it uses to control its operating 
units. The system measures progress in the conventional 
sense of sales, earnings and return on investment and forces 
operating personnel to focus their attention on critical 
areas and to think beyond the problems at hand to longer 
range objectives and strategy. 

The annual Business Plan, the primary document cf 


the reporting and control system is extremely comprehensive. 


127 





It is used as the primary standard for evaluating the perform- 
ance of unit managers. 

Fach January, the regional headquarters sets tentative 
objectives for the following two years for each of its operat- 
Pag Units. This 'first look' is an attempt to provide a 
broad statement of objectives permitting the operating units 
to develop their own detailed Business Plans. Objectives are 
established for both the unit as a whole and for each sep- 
arate product line. 

For each of the many product lines, objectives are 
established for five key measures: 

Sales 

Net Income 

Total Assets 

Total Employees 

Capital Expenditures 

From January to April, these tentative objectives 
are 'negotiated' between the regional headguarters and the 
operating managers. 

During May, the negotiated objectives are reviewed 
and approved by the regional and corporate headquarters. 

These final reviews focus primarily on the five key measures 
noted above. 

In June and July, the unit prepares its Business 
Plan, describing in detail how the subsidiary intends to 
achieve its approved objectives for the following two years. 

The Business Plan is broad in scope, beginning with 


a brief one-page financial and operating summary comparing 


Gitea fOr: 
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Preceding year (actual date) 
Current year (budget) 

Next year (forecast) 

Two years hence (forecast) 
Five years hence (forecast) 


This summary contains information dealing with the 
following measures for each of the five years: 


Net Income 
Sales 


Total assets 
Total capital employed (sum of long-term debt and 
net worth) 


Receivables 

Inventories 

Plant, property and equipment 
Capital expenditures 
Provision for depreciation 


return on sales 

return on total assets 

return on total capital employed 
total asset to sales 

receivables to sales 

inventories to sales 


oP oP oP WW oO oP 


Orders crecervea 
Orders on hand 


Average number of full-time employees 

Total cost of employee compensation 

Sales per employee 

Net income per employee 

Sales per $1000 of employee compensation 

Net income per $1000 of employee compensation 


Sales per thousand sguare feet of floor space 
Net income per thousand square feet of floor space 


Expected changes in net income for the current year 
and for each of the next two years are summarized according 


Eemthnelr cause. 
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This analysis forces operating managers to appraise the profit 
Tieulearelons OF all=management actions affecting prices, 
costs, volume or product mix carefully. 

These condensed reports are followed by a complete 
set of projected financial statements for the current year 
and for each of the next two years, with supporting detail 
provided for major items on the statements. 

The Business Plan contains a description of the 
Major management actions planned for the next two years with 
an estimate of the favorable or unfavorable effect of each 
one in monetary terms. 

Separate plans are presented for each of the func- 
tional areas: marketing, manufacturing, research and 
development, financial control, and personnel and employee 
relations. These plans state the function's mission, an 
analysis of its present problems and opportunities, and a 
list of specific actions projected for the next two years. 

The Business Plan closes with a series of compara- 
tive financial statements which depict the item-by-item 
effect if sales fall to 60% or to 80% of forecast or increase 
to 120% of forecast, For each of these levels of possible 
sales, costs are divided into three categories: fixed costs, 
unavoidable variable costs, and management discretionary 
costs. Management describes the specific actions it will 
take to control employment, total assets, and capital 
expenditures in case of a reduction in sales and also 


indicates when these actions would be put into effect. 
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By mid-summer the completed Business Plan is sub- 
mitted to company headquarters and in the early fall meetings 
are held at the regional headquarters to review each unit's 
Business Plan. At these sessions, top management often 
proposes changes before final approval of a unit's individual 
plan. 

The approved plan forms the foundation of the follow- 
ing year's budget. The budget's general design follows the 
BuSiness Plan's format except that the various dollar amounts 
are broken down by months. 

Every unit submits standard periodic reports to the 
regional headquarters on a fixed schedule. Then computer 
processing facilitates combining the results regionally and 
for the entire corporation. 

The main focus in the reports is on the variance 
between actual results and budgeted results. Data are pre- 
sented for both the latest month and for the year to date. 
Differences between the current year and the prior year are 
also reported. 

Thirteen different reports are submitted by the unit 
Seneroller on a monthly basis including: 

Statement of preliminary net income (within the first 
week after close) 

Statement of income 

Balance sheet 

Statement of changes in retained earnings 

Statement of cash flow 


Employment statistics 
Status of orders received, cancelled and outstanding 
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Statement of intercompany transactions 

Statement of transactions with headquarters 

Analysis of inventories 

Analysisis of receivables 

Status of capital projects (due last day of each month) 
Controller's monthly operating and financial review 

(20 or more pages) 

The final item contains an explanation of the signif- 
icant variances from budget, as well as a general commentary 
on the financial affairs of the unit. 

In addition, twelve other reports are required, either 
quarterly, semi-annually, or annually. 

A unit's periodic financial reports are reviewed by 
a financial analyst. This review focuses on a comparison of 
performance against budget for the five key measures -- sales, 
net income, total assets, total employees, and capital 
expenditures. Trouble spots or developing trends are detected. 
The written portions of the reports are also carefully 
reviewed. 

Although revisions of the forecasts are permitted, 
if the planned objectives are not met the situation is con- 
Sidered serious. 

Guidance is available from specialists or the product- 
line managers for unit managers who request help with their 
operations. 

Although the comprehensive reporting and control 
system makes it appear that ITT is a highly centralized 


organization, the managements of the various operating units 


actually have considerable autonomy. 
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As can be seen, the Business Plan of ITT has a number 
of similarities to, and a few differences from, the PPBS cycle 
used in DOD. 

A Similar structure and process is followed. The 
private company's regional and corporate headquarters can be 
compared to DON's major. claimant and Washington headquarters 
staffs. In both systems, objectives are set after a period 
of negotiations. Each organization establishes budgets for 
individual units, as well as functional programs. Each 
organization requires justification for funding requests and 
each budget goes through an elaborate approval process. The 
Business Plan serves as the basis for a unit's budget; the 
POM provides a basis for the military budget. Both Sectors 
have a reporting system, but the one presented in the case 
is more extensive. In both situations, the budgeting sys- 
tem implies a highly centralized organization but in fact, 
most of the individual units are quite autonomous. 

Differences between these two systems include: The 
febor system must work through many more layers -- the 
President, Congress, DOD, Navy, and finally the individual 
activity -- and in a political atmosphere, making control 
more complicated; the military does not use the budget as 
the primary standard for evaluating the performance of its 
managers, but focuses, instead, on the level of mission/ 
program attainment -- a subjective measure; the military 


budget is more amenable to adjustment than a unit's Business 
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Plan; the military service does not plan as carefully for 
under-or over-budget possibilities; nor does the military 
budget address management plans. 

Some of these differences could be adapted for federal 
government use. 

ITT's BuSiness Plan presents a concrete example 
demonstrating a Planning (what is to be done) and Control 
system (how it is to be done). Elements of strategic plan- 
ning, management control, and operational control can be 
found in the design. And it is clear that money is the 
common denominator among the heterogeneous inputs and outputs 
of the individual units. 

The focus 1S on management control. The management 
accounting information that is gathered provides management 
data which assures managers that resources obtained are used 
effectively and efficiently in the accomplishment of the 
unit's objectives. 

When performance 1S reviewed, a comparison is made 
of budget figures with actual figures but the written por- 
tions (nonquantifiable and nonmonetary data) of the reports 
are also carefully reviewed. Thus, rigid conformance to plan 
is not the only standard of measurement since within the 
management control system, administrative and accounting 


information are both considered. 
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Voter ecoNe suo ONS AND) RECOMMENDATIONS 


eee =LNYTRODUCTION 

The definition, objectives, and concepts of internal con- 
trol in common use today reflect the specialized needs of the 
independent auditor. 

There is little material adapting the existing writings to 
the broader needs of managers who require a focus on all sys- 
tems, not just those which provide financial information. 

This section will discuss some pertinent comments of the 
Special Advisory Committee on Internal Accounting Control that 
are directed to private sector managers’ concerns but are 
equally applicable to the public sector; then specific con- 
Siderations and recommendations for the public sector will be 


offered; finally a brief concluding statement is made. 


B. REMARKS 
As the Special Advisory Committee on Internal Accounting 
Semitol commented in 1979: 


Management is necessarily concerned about all of the con- 
trols contemplated in the 1949 definition of ‘internal 
Bemereol' ... controls that help to promote efficient and 
effective operations have been, and will continue to be, 
of vital importance to management. Also ... administra- 
tive controls may have a bearing on the selection and 
effectiveness of an (organization's) accounting control 
procedures and techniques ... administrative and operating 
procedures focusing upon specific business activities often 
complement accounting control procedures ... as business 
transactions and the procedures necessary to execute them 
hecome more complex, the difficulty of distinguishing be- 
tween accounting and administrative controls is increased. 
[Ref. 52] 


ie 





Thus managements' interests go beyond the confines of the 
narrow legal interpretation of the FCPA or the FMFIA to 

include all controls. As Grady stated in 1957 "... there 

are many endeavors wherein a broader concept of responsibility 
results ina lesser risk ..." Since his statement was made, 
events in both private and public sectors have demonstrated 

the shortcomings of the narrow application of internal account- 
mace Controls. 

A further comment of the Special Advisory Committee which 
is equally adaptable to private and public organizations states: 

The wide range in the size of these (organizations), in 
their operating styles, in the complexity of their trans- 
actions, in the diversity of their products (programs) and 
services, and in the geographical dispersion of their 
operations clearly makes it impossible to enumerate specific 
controls that will answer the needs of all (organizations). 
[Ref. 53] 

Thus, since internal control must be situation specific, 
it has created difficulty in the public sector in the coor- 
dination and summarization of reports and certifications 
throughout organization structures. Similar potential prob- 
lems exist in the corporate environment as well, but private 
sector managers are not currently required to report on the 
state of their internal control in quite as comprehensive a 
manner aS public sector executives do. 


Other statements of the Report require consideration by 


the spectrum of managers: 
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Control procedures and techniques have evolved ... 
based on the judgments of individual managements of 
their necessity and usefulness in specific 
circumstances. 


Subjective knowledge, experience, specific industry 
(programs) and business conditions, management style, 
cost-benefit judgments ... affect the selection of 
appropriate control procedures and techniques ... 

there is a necessary element of subjectivity inherent 
in an evaluation by management of internal ... control. 


... there is not sufficient empirical knowledge of how 
extensively control procedures and techniques are em- 
ployed ... the lack of knowledge of what (is) neces- 
sary for purposes of effective internal ... control 
further complicates the task of evaluation. 


(organization) do not have a comprehensive theoretical 
model to use in making informed, supportable judgments 
on the cost-benefit decisions implicit in developing 
their ... procedures and techniques. [Ref. 54] 


These comments restate the themes that internal control is 


Situation specific and that subjective knowledge and profes- 


Slonal judgment are required in the establishment and mainten- 


ance of a proper system. 


See UBLIC SECTOR CONSIDERATIONS 


The following comments are presented specifically for public 


sector managers' consideration: 


That the agencies directing the implementation of the 
internal control program within the federal government 
will recognize the value of emphasizing a management 
control framework which promotes the accomplishment of 
organizational goals and objectives; and within which 
administrative controls promote program and operational 
effectiveness and efficiency and support managerial 
policies, and accounting controls safeguard assets and 
provide accurate, reliable financial data. 
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The support of senior line managers iS critical and 
Should be gained with the focus described above since 
this broader concept is the only meaningful way in 
which internal control can be related to such managers' 
responsibilities and interests in accomplishing the 
goals and objectives of the organization. A narrow 
TOcMovOnMIneernal accounting Control, aiming to avoid 
legal problems, will not encompass these managers' 
wider concerns. 


Once this broader focus is cemented, training courses 
should be established which support this direction 
and give a more refined set of guidelines for the 
establishment and review of internal control systems 
than are currently available. The Arthur Anderson & 
Company approach mentioned previously should be a 
useful beginning because of the incluSive nature of 
their program. 


More research into the state of the art concerning 
systems of internal control with an emphasis on the 
concerns of managers is needed. Lessons learned could 
be presented in case study format so that organiza- 
tions could easily adapt useful ideas to their unique 
Situations. These same case studies could be useful 
in the aforementioned training courses. 


Since most control meaSures are based in large part 

on the fact that human beings make mistakes and often 
do not react to problems by undertaking adequate and 
prompt corrective action, the more qualified employees 
are, the more they will perceive deviations from plans 
and take timely action to prevent them. The most 
direct form of all control is to take steps to ensure 
the high quality of employees, commensurate with their 
responsibilities and at reasonable cost. 


A large measure of professional judgment 1s required 
to maintain and evaluate a dynamic internal control 
SYStem. 


Some thought should be given to the documentation of 
internal controls in common management/administrative 
areas by the cognizant organizations to avoid the 
redundant effort otherwise required by each individual 
aGeivaty . 
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bee CONCLUSION 

Pema aeCOgniced Laat ene Internal control concept is in 
a state of transition in the public sector. Even as organiza- 
tions struggle to establish systems based on the broad 
definition, OMB and DOD are narrowing the scope to internal 
accounting control to meet the FMFIA objectives. This shift 
can only add to the confusion of implementing a little under- 
stood program. However, this narrowing does make it easier 
to assess internal control by looking at information that is 
readily quantifiable and innovative approaches, such as the 
Burns System, can be useful here. Such an approach fails to 
consider management's broader range of responsibility for 
accomplishing its programs and operational activities ef- 
ficiently and effectively within prescribed policies, as well 
as safeguarding its assets and maintaining accurate, reliable 


accounting data. 
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